EDIBLOG · AI · ANTHROPIC LONDON KEYNOTE
Claude Agents Move Into Company Infrastructure — Two London Reveals
Anthropic held its London keynote yesterday, and two features landed on Managed Agents. You can now run Claude agents without ever sending your code and files outside the corporate network. This release lifts part of the adoption wall that had blocked fintech and enterprise teams.
01 · WHAT CHANGEDTool execution moved from Anthropic to your own infrastructure
Until now, Managed Agents ran everything — tool execution and file handling — on Anthropic’s infrastructure. Your company code had to be pushed to an external network at least once. This release splits off that execution layer.
Internal DB access impossible
Fintech adoption blocked
↓
Internal MCP server connection possible
Orchestration stays on Anthropic
02 · SELF-HOSTED SANDBOXTools run inside your network — Public Beta
This option places the sandbox where the agent’s code execution and file work happen inside the customer’s own infrastructure. Sensitive files, packages, and services never leave the network. If running it yourself is a burden, you can use one of four Anthropic-certified managed providers.
-
Cloudflare — sandbox hosted on Workers plus its own container runtime
-
Daytona — isolated workspaces purpose-built for dev environments
-
Modal — Python serverless with automatic GPU/CPU scaling
-
Vercel — frontend/full-stack build context
Between self-hosting and the four managed options, even teams with strict internal security reviews now have a path. Since it’s Public Beta, larger policy changes are still possible.
03 · MCP TUNNELSConnect internal MCP servers with zero external exposure
The second feature is MCP Tunnels. It lets Claude agents call MCP servers sitting inside your internal network without any inbound firewall rules. A gateway opens just a single outbound connection, and an end-to-end encrypted tunnel runs over it.
“To attach an internal DB or issue-tracker MCP to Claude, you needed a public endpoint.”
Root cause: calling an MCP server from outside required opening an inbound port plus an auth gate. The security team blocking it was the correct behavior. A workaround was, in the end, still a workaround.
connection
firewall rules
layer
stage
Access is by form application — not instantly available, which is the difference from the Public Beta Sandbox. For teams whose biggest hurdle was convincing the security team, it’s one more architecture card to play.
04 · POSITIONNot everything is unblocked — orchestration is still external
The agent loop, context management, and error handling still run on Anthropic’s network. A fully air-gapped on-prem deployment is not part of this release.
Tool execution · files · MCP server calls
Agent loop · prompts · model inference
Some financial institutions have policies that forbid “the prompt itself being sent to an external model.” This release doesn’t move that policy line. The structure is still “the code doesn’t leave, but the instructions do” — so some teams have to wait one more release.
“A signal that the axis of enterprise AI competition is shifting from model performance to the deployment boundary.”
— Eddie · 2026.05.20
A blocked adoption wall has been partly lifted. “Code stays inside the company, inference happens outside” is becoming the new default.
Disclaimer: A summary of Anthropic’s official announcement. No ads, no affiliate links. Not based on my own hands-on use — objective recap.
This post is part of an English mirror of a Korean dev experiments blog. Cross-posted for the global developer audience.