Anthropic adds MCP tunnels and self-hosted sandboxes to secure Claude Managed Agents

Anthropic tackles credential exposure in Claude Managed Agents

Anthropic has introduced two privacy and security features for Claude Managed Agents designed to address a fundamental barrier slowing enterprise AI agent deployments: the risk of credential exposure1

1

2

2

. The new capabilities, MCP tunnels and self-hosted sandboxes, shift how enterprises manage AI agent security by separating where agents orchestrate from where they execute tools. In most production deployments today, agents carry authentication tokens as they execute tool calls, meaning a compromised or misbehaving agent effectively takes the keys with it2

2

. This architectural vulnerability has kept enterprises cautious about connecting AI agents to internal APIs and databases, even as the underlying models have grown more capable.

MCP tunnels enable private network connectivity without exposure

The MCP tunnels feature allows Claude Managed Agents users to route services through a private network without exposing internal systems to the public internet1

1

. With MCP tunnels, agents can reach MCP servers inside private networks and access internal databases, private APIs, knowledge bases, and ticketing systems as tools they can call. The implementation relies on a lightweight gateway that enterprises deploy, which makes a single outbound connection with no inbound firewall rules and no public endpoints, while traffic remains encrypted end to end1

1

. This approach moves credential control to the network boundary rather than embedding it within the agent's context2

2

. MCP tunnels is currently available as a limited research preview, requiring access requests before teams can begin implementation.

Self-hosted sandboxes keep tool execution within enterprise boundaries

The self-hosted sandboxes feature lets enterprises set boundaries for Claude Managed Agents by keeping sensitive data, files, packages, and services within their own infrastructure or with a managed sandbox provider1

1

. The architecture splits responsibilities: the agent loop that handles orchestration, context management, and error recovery stays on Anthropic's infrastructure, while tool execution moves to the enterprise's own configured execution environment1

1

. This separation allows agents to complete tool calls without holding the authentication tokens that unlock access to sensitive systems2

2

. Self-hosted sandboxes arrive as a public beta feature and support bringing your own sandbox client or using partners including Cloudflare, Daytona, Modal, and Vercel.

Securing AI agent credentials changes the threat model for enterprises

For orchestration teams managing enterprise AI agent deployments, these capabilities represent more than a security update—they fundamentally change the threat model by enabling better agent workflow mapping2

2

. Since sandboxes determine tool execution locations and the resources agents access, while MCP tunnels define how agents reach internal systems, splitting these concerns enables enterprises to map agents' workflows more effectively. Anthropic positions this split architecture as a key differentiator from other approaches. OpenAI added local execution to its Agents SDK in April in response to similar demand, but Anthropic draws an architectural distinction: existing sandbox approaches, including OpenAI's, don't separate the agent loop from tool execution in the same way2

2

. For teams already using Claude Managed Agents, the practical starting point is sandboxes—moving tool execution onto their own infrastructure and testing the boundary before exploring MCP tunnels, which remain in research preview. Teams evaluating the platform for the first time should treat the sandbox architecture as the primary technical differentiator, as it changes the threat model rather than just the deployment model.