secure-deployment-risks changedmanaged-agents/secure-deployment-risks
Nearest release: v2.1.309, published 3 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+8added
Lines−8removed
From line
31
where the diff opens
First seen
13 Oct 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 31, old and new numbered
/
from line 31
3131
3232Managed Agents keeps the agent loop, session history, and vault secrets outside the sandbox by design. For the design background, see [Scaling Managed Agents](https://www.anthropic.com/engineering/managed-agents).
3333
34| Part | Where it runs | What limits it |
35| ---------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| Agent loop | Anthropic's servers | The tool set, permission policies, and budget that you set |
37| `bash` and file tools | The sandbox. In a cloud environment, each session gets its own isolated Linux container | Environment networking, the tool set, and permission policies |
38| `web_search` and `web_fetch` | Anthropic's servers | The tool's own domain list and, in a `limited` cloud environment, the environment's allowed hosts. `web_fetch` also opens only URLs that have already appeared in the session |
39| Vault secret | Outside the sandbox. MCP credentials never enter it. For an environment variable credential, code sees a placeholder | For an MCP credential, the MCP server URL it is for. For an environment variable credential, the hosts the credential allows, its injection location, and the environment's allowed hosts |
40| Session history | Anthropic's servers, until you delete the session | The API keys for the workspace, the Developer and Admin roles in the Claude Console, and session deletion |
41| Custom tools | Your application | Your code |
34| Part | Where it runs | What limits it |
35| ---------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| Agent loop | Anthropic's servers | The tool set, permission policies, and budget that you set |
37| `bash` and file tools | The sandbox. In a cloud environment, each session gets its own isolated Linux container | Environment networking, the tool set, and permission policies |
38| `web_search` and `web_fetch` | Anthropic's servers | The tool's own domain list, your organization's web search and web fetch settings in the Claude Console, and, in a `limited` cloud environment, the environment's allowed hosts. `web_fetch` also opens only URLs that have already appeared in the session |
39| Vault secret | Outside the sandbox. MCP credentials never enter it. For an environment variable credential, code sees a placeholder | For an MCP credential, the MCP server URL it is for. For an environment variable credential, the hosts the credential allows, its injection location, and the environment's allowed hosts |
40| Session history | Anthropic's servers, until you delete the session | The API keys for the workspace, the Developer and Admin roles in the Claude Console, and session deletion |
41| Custom tools | Your application | Your code |
4242
4343In a cloud environment, sessions do not share filesystem state. A memory store attached to more than one session is shared between them.
4444
No line in this hunk matches that.