Anthropic decouples Claude's agent harness from the sandbox

Anthropic's Applied AI team published a deeper write-up of how Claude Managed Agents are built, focused on a single architectural shift: separating the agent harness (the loop that calls Claude and decides what to do next) from the sandbox where code actually runs. In the older monolithic pattern, harness and execution lived in the same container, which meant agent code shared a filesystem and credentials with the orchestrator. In the new pattern, the harness runs on Anthropic's side while the sandbox runs separately, either on Anthropic-managed infrastructure or self-hosted by the customer.

The piece breaks the system into three primitives. Agents are the configuration object: prompt, tools, and guardrails. Environments are the execution context, with the option to point at a private VPC through an MCP tunnel for internal services. Sessions are append-only event logs of model calls, tool executions, and results, which makes runs resumable and inspectable instead of opaque. Two numbers are worth flagging: Anthropic reports a roughly 60% median improvement in response time and over 90% in worst-case scenarios, because Claude can reason while the environment spins up in parallel. Credential isolation is the other concrete win. Tokens live in a separate vault with envelope encryption, so prompt injection inside a session cannot pull them into the model's context.

Why it matters

If you build agents in production, this is the closest thing Anthropic has published to a reference architecture for the harness and sandbox split, and the latency numbers explain why their managed runtime is faster than rolling your own. Pay particular attention to the session log model: any team running long agent loops without an inspectable event log is going to regret it the first time a run goes wrong in production.