Anthropic launches Managed Agents: TTFT drops 60% after separating the "brain" from the "hands"

Anthropic has released Managed Agents, a hosted service in Claude Platform that runs long agent tasks on the user's behalf. The headline engineering number: after separating the "brain" (Claude and its harness) from the "hands" (sandboxes and tools), median time to first token fell by roughly 60%, and the 95th percentile fell by more than 90%. The team described the architecture on the Anthropic Engineering blog.

Why the old design didn't work

The first version was simple: the session, harness and sandbox all lived in one container. File edits were plain system calls, and there were no service boundaries to design. But the engineers ended up with a classic "pet" from the pets-vs-cattle analogy: a named server that you can't afford to lose and have to nurse back to health. If the container died, the session was lost.

Debugging became a problem. The only window inside was the WebSocket event stream, and it couldn't tell a harness bug from a dropped packet or a container that had gone offline. To investigate, an engineer would have had to open a shell inside the container, which often holds user data. In practice, there was no way to debug.

The second problem was that the harness assumed everything Claude works with sits right next to it. Customers who wanted to connect Claude to their own VPC had to either peer their networks with Anthropic's or run the harness themselves.

How the separation works

Anthropic virtualized the agent's components along the lines of operating systems, where abstractions like the process and the file outlived changes in hardware. It defined three interfaces: session (an append-only event log), harness (the loop that calls Claude and routes its requests to tools) and sandbox (the code execution environment).

The harness now calls the container like any other tool: execute(name, input) → string. If the container dies, the harness receives a call error and passes it to Claude, which can request a new one via provision({resources}). The harness itself is also interchangeable: because the log lives outside, after a failure a new instance spins up via wake(sessionId), reads the history via getSession(id) and continues from the last event. Writes go through emitEvent(id, event).

Security was reworked separately. Previously, Claude-generated code ran next to credentials, so a prompt injection only had to convince the model to read its own environment. Now the tokens are not reachable from the sandbox. For Git, the repository token is used at initialization to clone and to wire up the local remote, so push and pull work without the agent having access to the token. For custom tools via MCP, OAuth tokens sit in a secure vault, and calls go through a proxy that receives a session token. The harness does not see the credentials.

A session is not a context window

For tasks that exceed the model's context, teams usually rely on compaction, a memory tool and trimming of old tool results. All of these are irreversible: you can't know in advance what will be needed later. In Managed Agents, the session log acts as a context object outside Claude's window. Through getEvents(), the brain reads slices of the event stream: it picks up where it left off, rewinds to just before a key moment, or rereads context before acting. Transformations (including those that keep the prompt cache hit rate high) remain the harness's job.

Key metrics and properties

• p50 TTFT: down by roughly 60%.
• p95 TTFT: down by more than 90%.
• A container is created only when a tool requests it, so sessions that don't need a sandbox don't wait for repository cloning and process boot-up.
• The execute(name, input) → string interface covers custom tools, MCP servers and Anthropic's own tools.
• The harness doesn't know what is behind a "hand": a container, a phone or a Pokémon emulator.

Practical takeaway

The whole design stems from assumptions going stale. Anthropic cites the example of Sonnet 4.5's "context anxiety," which made the model wrap up tasks early. Context resets in the harness fixed it, but on Opus 4.5 the behavior disappeared, and the resets became dead weight. For teams building agents, the lesson is this: keep state outside the executor, don't put secrets next to the model's code, and treat every workaround in the harness as temporary. The service is offered as a meta-harness: you can run Claude Code or narrowly specialized harnesses inside it. Documentation on getting started is available on the Anthropic platform.