Claude Managed Agents: how hosted agents work and cost

Claude Managed Agents is Anthropic's hosted agent: you describe an agent once, start a session for each task, and Anthropic runs the loop of model calls and tool calls in a sandbox it provisions, streaming every step back to your app. You write no loop, host no container and keep no conversation state. The price is the model's normal token rates plus $0.08 for each hour a session is actually working. It is in beta, behind the managed-agents-2026-04-01 header.

That makes it the third way to build a Claude AgentAgentA model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done., next to writing the loop yourself on the Messages API and running the Claude Agent SDK on your own machines. This guide covers how the parts fit, a first session in Python, what it costs, and the defaults worth changing before you rely on it.

The 4 parts: agent, environment, session, events

A managed agent is built from 4 objects, and only 1 of them is created per task.

The agent is configuration, not a process. Each update creates a new version, and a session can override the model, prompt or tools for one run without touching the stored agent. Environments are not versioned, so if you change one often, keep your own record of which settings each session ran with.

Each session gets its own sandbox, even when 100 sessions share an environment, and sessions never see each other's files. The history and the sandbox's state live on Anthropic's side, which is why a session can sit idle for hours and pick up where it stopped.

A first session in Python

A working session takes 3 create calls and a stream. This one asks the agent to profile a CSV file and write a short report, the kind of job that needs bash, files and a few minutes:

from anthropic import Anthropic

client = Anthropic()

# Once: the agent and its sandbox settings. Store both IDs.
agent = client.beta.agents.create(
    name="CSV profiler",
    model="claude-sonnet-5-5",
    system="You profile data files. Report row counts, nulls per column and odd values. Be brief.",
    tools=[{"type": "agent_toolset_20260401"}],
)
env = client.beta.environments.create(
    name="profiler-env",
    config={
        "type": "cloud",
        "networking": {"type": "limited", "allowed_hosts": ["data.example.com"], "allow_package_managers": True},
    },
)

# Per task: a session, with a spending cap of $2.00.
session = client.beta.sessions.create(
    agent=agent.id,
    environment_id=env.id,
    budget={"type": "limit", "max_list_cost": {"amount": "200", "currency": "USD"}},
)

with client.beta.sessions.events.stream(session.id) as stream:
    client.beta.sessions.events.send(session.id, events=[{
        "type": "user.message",
        "content": [{"type": "text", "text": "Download https://data.example.com/orders.csv, profile it and save report.md."}],
    }])
    for event in stream:
        if event.type == "agent.tool_use":
            print(f"[tool] {event.name}")
        elif event.type == "agent.message":
            print("".join(b.text for b in event.content if b.type == "text"))
        elif event.type == "session.status_idle":
            break

3 details in that code come straight from the docs. The stream is opened before the message is sent, so no event is missed. The loop ends on session.status_idle, because a session that finishes its work goes idle, not terminated. And the budget's amount is a string of whole US cents.

The agent_toolset_20260401 line turns on 8 built-in tools: bash, read, write, edit, glob, grep, web fetch and web search. Tools of your own are declared on the agent too; when the agent calls one, your app gets an agent.custom_tool_use event and answers with user.custom_tool_result, which is how a managed agent reaches a database or API that only your servers can see. That is ordinary Tool UseTool UseGiving a model a list of things it can ask to have done, such as search the web or read a file. The model asks; the program around it does the work and hands back the result., with the loop on the other side.

What Claude Managed Agents costs

You pay for tokens at the model's normal price and $0.08 per session-hour of running time, and the second part is almost always the small one. Runtime is counted to the millisecond, and only while the session's status is running. Time spent idle, waiting for your next message or for someone to approve a tool call, costs nothing, and so does time spent retrying after a transient error. The runtime fee replaces the container-hour charge of the code execution tool, so there is no second sandbox line.

Anthropic's own example: a 1-hour coding session on Claude Opus 5.5 that reads 50,000 tokens and writes 15,000 costs $0.20 for input, $0.30 for output and $0.08 for runtime, $0.58 in all. With 40,000 of those input tokens read from the cache, it falls to $0.428.

The tokens are where the money goes, because an agent re-sends its history on every turn: a task that makes 30 model calls over a 25,000-token history reads 750,000 tokens. Set your own task below:

Try itWhat a month of Managed Agents sessions costs

Opus 5.5Sonnet 5.5Haiku 5.5

Tasks a day

50

Working, per task

12 min

Waiting for a person, per task

45 min

Input tokens, per task

800K

every turn re-sends the history

Output tokens, per task

20K

NoneHalf80%

One task's session

running 12 min, billedidle 45 min, free

The month$900

Input $480Cache reads $96Output $300Session runtime $24

With the starting values, 50 tasks a day on Claude Sonnet 5.5 that each work for 12 minutes and read 800,000 tokens (80% of them from the cache), the month comes to about $900. Runtime is $24 of it, under 3%. A task would have to keep running for over 7 hours before its runtime cost as much as its tokens. So the levers that matter are the same ones as for any agent: the model, the cache and the number of turns. Our prompt caching calculator shows what the cache saves for a given prompt, and what an AI agent costs per month compares the token side across makers.

3 pricing details are easy to miss:

• No batch discount. Sessions are interactive, so the Batch API's half price never applies.
• US-only inference costs 10% more. An agent whose model is pinned to inference_geo: "us" pays 1.1 times the token rates.
• Web searches are extra, at $10 per 1,000, the same as on the Messages API.

Every session can carry a hard cap, the budget in the code above. When the running list cost reaches it, the session stops making model requests and goes idle with the stop reason budget_reached. The call that crosses the line still finishes, so the final cost can land a little past the cap. A budget can only be set when the session is created; you can raise, lower or remove it later, but not add one to a session made without it. Why every agent needs a limit like this is in AI agent budget limits.

The defaults to change before you ship

2 defaults are open by design, and both are a 1-line change.

Networking. An environment created through the API with no networking field gets unrestricted, meaning code in the sandbox can reach any host outside a general safety blocklist. (The Console's form starts on Limited instead.) Set limited with an allowed_hosts list, as in the code above, and add allow_package_managers if the agent installs packages. With limited networking the same list also governs the web search and web fetch tools, which run on Anthropic's servers; how to limit what an agent can fetch covers the domain rules.

Tool approval. The built-in tools default to always_allow, so bash commands run without asking. MCP tools default to always_ask. For an agent that can change things outside the sandbox, set bash to always_ask, where the session pauses for a user.tool_confirmation event, or to auto, where Anthropic's server runs, denies or pauses each call itself. A running session keeps the tool settings it started with, so a change applies to new sessions only.

For secrets, use a vault rather than an environment variable you set yourself. A vault's environment_variable credential sits in the sandbox as a placeholder and is swapped for the real value only when a request leaves the sandbox, so the agent never sees the secret. Vaults belong to the workspace: any API key with workspace access can attach one to a session.

What the cloud sandbox gives you

Each cloud session runs in an Ubuntu 24.04 container with up to 8 GB of memory and 10 GB of disk. Python 3.10 to 3.13, Node.js, Go, Rust, Java 21, Ruby, PHP and C/C++ are installed, along with pandas, NumPy, Matplotlib and the document libraries, so most data and coding tasks start without an install step.

When those limits do not fit, or the data may not leave your network, a self-hosted sandbox runs the tools on a worker you operate. The files and processes then stay with you, but the conversation and every tool result still go to Anthropic, because that is how the model reads them. You also give up some cloud features: mounted files and GitHub repositories, skills found in a repository, vault environment variable credentials and the pre-installed runtimes.

Limits and catches

• It is a beta. Every request needs the managed-agents-2026-04-01 header (the SDKs add it), and Anthropic says behaviour may be refined between releases. Pin what you can and test after updates.
• No Zero Data Retention. Sessions store their history, sandbox state and outputs on Anthropic's servers, so Managed Agents is not eligible for Zero Data Retention or a HIPAA BAA. You can delete sessions and files through the API.
• Not on Amazon Bedrock. It runs on the Claude API, Claude Platform on AWS and Claude Models on Google Cloud (Anthropic managed), the last 2 with some differences. On Bedrock you write the loop yourself; Amazon Bedrock vs the direct API lists what else is missing there.
• Rate limits per organization: 300 create requests and 1,200 read requests a minute, on top of your usual API limits. Creating an agent per request burns the first one quickly; create agents once and store their IDs.
• Big tool outputs go to a file. An output over 100,000 characters (about 25,000 tokens) is saved in the sandbox, and the model gets a preview and the path.
• Scheduled runs drift. A scheduled deployment starts a session on a cron schedule, at most once a minute, but each run may start up to 15% of the interval late (5 seconds to 9 minutes), so do not use it where the exact minute matters.

Managed Agents, the Agent SDK or your own loop

Pick Managed Agents when you would otherwise build the sandbox and the session store yourself. Long tasks that run for minutes or hours, agents that wait on people between steps, and jobs on a schedule are its strength: idle time is free, the history survives, and there is no fleet of containers to keep patched.

Pick the Claude Agent SDK when the agent must run inside your own process, on your own machines, with Claude Code's tools and hooks. Pick your own loop on the Messages API when you need Bedrock, the Batch API's half price, Zero Data Retention, or a control flow that no harness gives you. LangGraph vs CrewAI vs the Claude Agent SDK compares the frameworks for that path, and how to evaluate an AI agent applies to all 3, because a hosted loop still needs tests before you trust it. To price an agent before you build it, the agent cost simulator runs a task on every current model.