Claude Managed Agents.
On your box.
Anthropic runs the agent loop, model, and skills. Every tool call -- bash, read, write, edit, glob, grep -- executes inside an isolated OmniRun Firecracker microVM on your own infrastructure.
Brain and hands
Where each part of a session runs.
The brain stays at Anthropic
Anthropic hosts the model, runs the agent loop, and decides which tools to call. You don't run inference or manage the orchestration. Nothing about the agent itself changes.
The hands run in your microVM
Each session gets a fresh OmniRun Firecracker microVM on your own box, and its tool calls run there -- its own kernel, the same model AWS Lambda and Fargate use. Your code never leaves your perimeter.
Isolation, inside your own perimeter.
One microVM per session.
Every bash, read, write, edit, glob, and grep in a session runs in that session's own Firecracker microVM with its own Linux kernel. Sessions never share a VM. Isolation is enforced by KVM, not process boundaries.
Egress you control
Session sandboxes have internet on, with open outbound egress, because agents need package registries and git. The OmniRun API's opt-in SNI proxy can limit HTTPS to an allowlist of hostnames (a guard rail, not a firewall), but the worker does not switch it on yet.
Runs on your own box
The worker and every microVM run on infrastructure you control. EU-hosted on Hetzner if you use ours.
One worker. That's the whole integration.
Create a self_hosted environment, point the worker at it, and start polling. The worker picks up tool calls from Anthropic's queue and runs each one in a fresh OmniRun microVM. Agent sandboxes restore from snapshot in a few seconds (sub-5s).
# Install Anthropic's worker CLI (ant)
$ curl -fsSL https://github.com/anthropics/anthropic-cli/releases/download/v1.10.0/ant_1.10.0_linux_amd64.tar.gz \
| tar -xz -C /usr/local/bin ant
# Point it at your self_hosted environment
# (key generated once in the Console)
$ export ANTHROPIC_ENVIRONMENT_KEY=sk-ant-oat01-...
$ export ANTHROPIC_ENVIRONMENT_ID=env_...
# Poll the queue. Each claimed session runs
# in a fresh OmniRun microVM (via spawn.sh)
$ ant beta:worker poll --on-work ./omnirun-spawn.sh
✓ Connected to Anthropic work queue
✓ Each session runs in your microVMsBuilt for regulated workloads.
EU-hosted
Run on Hetzner data centers in the EU, or on your own hardware. Where your sandboxes run is an infrastructure choice you make.
ZDR / HIPAA-BAA eligible
The architecture supports Anthropic's Zero Data Retention and HIPAA-BAA programs. Eligibility is configured on the Anthropic side and covers Anthropic's processing only; OmniRun itself holds no HIPAA or SOC 2 attestation.
Your data, your perimeter
Tool calls touch files and run commands inside VMs you control. The repositories and data never have to leave your infrastructure.
What it does not do (yet).
- Persistent Memory is not yet available with self-hosted sandboxes. Each session starts from a clean snapshot.
- Anthropic runs the model. The prompt and conversation still flow through Anthropic's API. Self-hosting moves the tool execution, not the inference.
Keep the hands at home.
Get an API key, run the worker, and point a Claude session at your self-hosted environment. Free tier includes 25 sandbox-hours per month.