Claude Managed Agents: What It Is, How It's Billed and When to Use It

It comes with prompt caching and compaction built in, and it's available on the Claude API, Claude Platform on AWS and Claude Models on Google Cloud, where Anthropic manages it. The other way to build is the Messages API, which gives you direct access to the model and leaves everything else to you. If you're new to that side, my explainer on what the Claude API is covers the basics. Here's how the two compare, and what a managed agent costs to run.

Messages API or managed agent: which one fits

	Messages API	Claude Managed Agents
What you get	Direct model prompting access	A pre-built, configurable agent harness in managed infrastructure
Best for	Custom agent loops and fine-grained control	Long-running and asynchronous work
You build	The loop, tool execution and runtime	The agent definition and environment
Billing	Tokens	Tokens plus $0.08 per session-hour of running time

Anthropic says managed agents suit jobs lasting minutes or hours with many tool calls, cloud infrastructure with pre-installed packages, self-hosted running for compliance or data residency, teams that want minimal infrastructure, stateful sessions with persistent file systems, and work that runs on a cron schedule.

The four building blocks

• Agent: the model, system prompt, tools, MCP servers and skills. You create it once and reuse it by its ID.
• Environment: where sessions run, either an Anthropic-managed cloud sandbox or a self-hosted sandbox on your own infrastructure.
• Session: a running agent instance doing a task.
• Events: the messages passed between your application and the agent.

Agents are versioned. A session started with an agent ID runs the latest version, but you can pin a version to stage a rollout, or override part of the set-up, such as trying a different model, for one session without changing the agent. Overrides replace a field in full and never merge. Supported models include Claude Opus 5.5, Opus 5, Sonnet 5.5, Fable 5.1, Fable 5, Mythos 5.1, Mythos 5 and Mythos preview, plus older Opus 4 and Sonnet 4 versions.

How a managed agent run works, step by step

1. Create an agent, choosing the model, system prompt, tools, MCP servers and skills.
2. Create an environment: Anthropic's cloud sandbox or your own self-hosted one.
3. Start a session that references both.
4. Send a user event and stream the results back.
5. Steer or interrupt by sending more events, then fetch the full event history afterwards, because it's stored on Anthropic's side.

To get started you need a Claude Console account, an API key from the Console, and a command-line tool called ant, which installs through Homebrew on macOS.

Built-in tools and who approves them

The built-in agent toolset has eight tools, all switched on when you include it: bash, read, write, edit, glob, grep, web_fetch and web_search. You can switch off any of them, say web_fetch, and web access can be limited to an allowlist or blocklist of domains. Custom tools you define run in your own application and hand results back to Claude. When a tool's output runs past 100,000 characters, about 25,000 tokens, it's written to a file in the sandbox and the model gets a short preview plus the file path.

Permission policies decide whether server-run tools go ahead automatically (always_allow), wait for your approval (always_ask) or have each call judged by the server (auto). By default the agent toolset is always_allow and MCP toolsets are always_ask. Custom tools aren't governed by these policies, because they run on your side.

Sandboxes and networking modes

You create an environment once and reference its ID in each session. Sessions can share an environment, but each gets its own isolated sandbox, a fresh Linux container. Packages can be pre-installed from apt, cargo, gem, go, npm or pip, and they're cached across sessions that share the environment.

Networking has two modes. Limited allows only the hosts you list, with optional switches for package managers and MCP servers. Unrestricted gives full outbound access apart from a general safety blocklist. Under limited networking the allowed-hosts list applies to web_search and web_fetch too, so fetching a page from a host that isn't on the list returns an error to the agent.

What a session costs: Anthropic's worked example

Billing has two parts. Every token in a session is billed at the standard model rates, with prompt caching multipliers applied the same way, and web search inside a session costs $10 per 1,000 searches as of October 2026. Session runtime is $0.08 per session-hour, measured to the millisecond and only while the session's status is running. Time spent idle, waiting for your next message or a tool confirmation, rescheduling or terminated doesn't count. It replaces container-hour billing, so there's no container charge on top.

Anthropic's example uses Claude Opus 5.5, at $4 per million input tokens and $20 per million output tokens, with cache hits at 0.05x the base input price. A 1-hour session with 50,000 input and 15,000 output tokens works out like this:

Line	No caching	With 40,000 input tokens as cache reads
Input tokens	$0.20	$0.04 uncached plus $0.008 cache reads
Output tokens	$0.30	$0.30
Runtime, 1 hour	$0.08	$0.08
Total	$0.58	$0.428

Three billing details are easy to miss. Pinning an agent's inference to the US bills tokens at 1.1x standard rates. The Batch API discount doesn't apply, because sessions are stateful and interactive. And partner-cloud pricing doesn't apply either.

Scheduled deployments and per-run budgets

Scheduled deployments start sessions on a cron schedule, using standard POSIX cron with an IANA timezone, down to the minute. Each run starts with a small random delay of at least 5 seconds and no more than 9 minutes, and each organisation can have up to 1,000 scheduled deployments. A deployment can carry a budget that's copied onto every session it starts, so it caps each run separately rather than acting as a running total. A session pauses with a budget_reached status when its own list cost hits the cap, and every attempt creates a run record, so failures are tracked apart from the session.

One agent or several

One agent can coordinate others. It can hand work to subagents, each in its own session thread you can list and stream, write a dynamic workflow that runs many agents in the background and combines the results, or consult an advisor model mid-turn. Anthropic's 22 October 2026 engineering article adds a useful counterweight: using fewer subagents, with context and tools disclosed progressively, can improve quality while cutting cost and latency. If you know subagents from the coding side, my guide to Claude Code subagents explains that version.

The beta limits to check first

As of October 2026, Managed Agents isn't eligible for Zero Data Retention and isn't HIPAA eligible. Sessions are stateful, and transcripts persist until you delete them, which is why every Managed Agents feature carries the no-ZDR flag.

My verdict on Claude Managed Agents

If your developers are about to build an agent loop, sandbox and tool runner from scratch for a long-running job, I'd price this first, because idle time is free and the runtime charge is small next to the tokens in Anthropic's own example. I wouldn't put health data or anything that needs Zero Data Retention through it while it's in beta. And for scheduled jobs, I'd set a per-run budget on every deployment from day one.

If you're deciding whether an AI agent is worth building for your business at all, and what it should do first, that's the kind of thing I help with. I run AI training and workshops for teams, and help businesses with AI enablement, AI automation and GEO, which is about getting your business seen and cited in AI answers. Most of that work is with SaaS marketing teams, telecom companies and small businesses. Here's how we can work together.

Frequently asked questions

How much does Claude Managed Agents cost?

As of October 2026, you pay standard token rates for the model plus $0.08 per session-hour of running time. Web search inside a session is $10 per 1,000 searches.

Am I billed while a managed agent waits for me?

No. Session runtime only accrues while the session is running. Idle time waiting for your next message or a tool confirmation doesn't count.

Is Claude Managed Agents HIPAA eligible?

No. During the beta it's marked as not eligible for Zero Data Retention and not HIPAA eligible, because sessions are stateful and transcripts persist until you delete them.

What's the difference between the Messages API and Managed Agents?

The Messages API gives direct model access for custom agent loops. Managed Agents is a pre-built, configurable agent harness in managed infrastructure, built for long-running and asynchronous work.