Anthropic reports roughly a 90% drop in time to first token after rebuilding Claude Managed Agents so the harness no longer waits for a sandbox container. The redesign turned every component except the append-only session log into something disposable. This article walks through the three interfaces, the egress credential proxy, and the environment-agent-session flow.
What an agent and a harness actually are
An agent is a model in a loop with tools. The model decides the next action, calls a tool, reads the result, and repeats until the task is done. A harness is the layer wrapping that model: it makes the tool calls in a loop, manages context, and fills the gaps the model cannot cover on its own.
Priyanka, the Anthropic technical staff member who leads the engineering team behind Claude Managed Agents, gave the sharpest example of what "filling the gaps" means. Sonnet 4.5 had a behaviour her team called context anxiety. Whenever the model sensed it was approaching the context limit, it would try to wrap up the task as quickly as possible. Anyone building a harness around Sonnet 4.5 had to add something like a context reset to work around that. Opus 4.5 did not have the limitation, and the same context reset was unnecessary.
The lesson matters more than the example: harnesses encode assumptions, and assumptions go stale with every new model. The next section shows what happened when Anthropic ignored that.
Why Anthropic decoupled the brain from the hands
In December 2024, Anthropic shipped its first managed-agent architecture to early access customers. Everything ran inside one container: the session log, the harness, and the sandbox execution. There were no service boundaries to design, everything was local, and a file edit was a local syscall.
The team later described the result as having adopted a pet. In the old infrastructure pet-versus-cattle analogy, a pet is named and hand-tended; when it gets sick you nurse it back to health because you cannot afford to lose it. Cattle are interchangeable. A single database shard is a pet, because when it goes down the product goes down. A master with replicas is cattle, because losing one instance is survivable. The first architecture was a pet, and it produced three problems:
- Debugging was ambiguous. A dropped packet and a dead container looked nearly identical from outside, so engineers had to websocket into the container to investigate.
- Investigation was blocked by customer data. Customer data lived on those containers, leaving the team no clean way in.
- Customer networks were unreachable. Connecting to an MCP server inside a customer VPC meant either peering networks or shipping the harness to the customer to run.
Rather than patch around those constraints, Anthropic split the agent into three interfaces and provisioned the hands on demand.
The three interfaces: session, harness, hands
The redesign made the agent three separate interfaces, and only one of them holds state.
The session log is the only durable piece
The session is the unit of work and holds an append-only log of every event so far. It is the single component worth protecting. Everything else is disposable.
The harness is the brain
The harness is the agent loop plus Claude. It is interchangeable: when a harness dies, a new instance starts, reads the event log from the session, and resumes from the last event as if nothing had failed.
The hands are provisioned on demand
The hands are sandboxes, MCP tool calls, and anything else the model needs to reach. They are created when work arrives and destroyed when it finishes. If a sandbox dies mid-task, the failure returns to Claude an ordinary failed tool call, and the model decides whether to spin up a new sandbox or continue without it. One brain can call a sandbox container, reach into a customer VPC, or call an MCP server, and those hands are interchangeable.
How credentials stay out of the sandbox
In the first architecture, credentials sat inside the sandbox, which made prompt injection a live risk. The redesign routes token-bearing outbound calls through a proxy that injects the credential before the request reaches the external endpoint or MCP server. The model never sees the token, so a prompt injection asking Claude to print the token or write it to a file has nothing to read.
That changes the blast radius of an injection from credential theft to a single malformed request.
How the ~90% time-to-first-token cut was achieved
The harness no longer waits for a sandbox container to start before making its first inference call. It starts the call immediately and spawns a sandbox only when the model actually needs one, which Anthropic reports cut time to first token by about 90%. The figure is vendor-reported and the absolute latencies were not published. Faster first token is not a benchmark on its own; it is what happens when the critical path stops including container startup.
How the append-only log keeps compaction flexible
Most agent runtimes compact the event stream in place, discarding history to fit context. Anthropic stores every event and moves the compaction decision to read time.
The strategy can then choose how much history to place in context: the entire log summarized, or only the last N events. Nothing is thrown away, and because the decision lives at read time, changing it does not rewrite the stored record. That is the practical payoff of designing interfaces to outlast assumptions.
What the environment, agent and session APIs do
Building an agent in the Anthropic console follows three steps in order. First the environment (v1 environments), then the agent, then the session. Environments and agents are reusable; sessions are per task.
| API | What you configure | Key fields |
|---|---|---|
| Environment | The sandbox template | Networking (unrestricted, or restricted to specific domains and MCP servers), installed packages |
| Agent | The brain | Name, model (Opus, Haiku or Sonnet), system prompt, tools |
| Session | The unit of work | An agent ID and an environment ID; starts idle until the first event |
Step 1: create the environment
The environments API defines the template for the sandbox. You choose whether networking is unrestricted or restricted to specific domains and MCP servers, and you declare the packages installed in the container.
Step 2: create the agent
You name the agent, choose its model, and supply a system prompt and tools. Anthropic demo agent is named joke teller, runs on Opus, and carries the prompt "You're a comedian. Find a fresh joke on the topic. Deliver it well." Most agents also need the agent tool set, the basic set covering bash, read, write and grep.
Step 3: create the session
A session takes an agent ID and an environment ID. It is created idle and does no work until you send an event. The event stream then carries both your events and the agent's replies.
Reading the session event stream
The event stream is where the agent's behaviour becomes observable, and it is worth knowing what each event means before you debug anything:
- User message — your input, for example "tell me a joke about distributed systems."
- Custom tool use — Claude a custom tool use event on the stream, you handle it yourself, then return the result in a tool result event. This is how you plug your own systems into the loop.
- Session error — the session hit an error.
- Idle — the session is not working, typically because no sandbox is in use.
- Interrupt — you stop or kill the session and drop the work.
Where Gustavo Dev Doido and Crazystack Typescript fit
Readers who arrived from Brazilian developer content may recognize Gustavo Dev Doido, whose material covers TypeScript and full-stack development, and Crazystack Typescript, a TypeScript-focused course track published at crazystack.com.br. The Bootcamp do Dev Doido is the same author's longer training program for developers moving into professional software work.
Those resources address a different layer than Claude Managed Agents. They teach the application code and TypeScript skills you bring to a project, while managed agents handle the runtime that executes agent work. A developer comfortable with TypeScript APIs will find the environment, agent and session calls in this article familiar in shape, and the quick-start flow in the Anthropic console requires no code at all.
FAQ
What is a Claude Managed Agent?
It is Anthropic managed runtime for running an agent as three interfaces: an append-only session log, a harness loop with Claude on-demand sandboxes and tools. Anthropic docs describe the environment, agent and session resources you use to configure one.
What is a harness in an agent?
A harness is the layer wrapping the model that makes tool calls in a loop, manages context, and compensates for what the model cannot do. Harnesses encode model-specific assumptions, such as the context reset Anthropic added around Sonnet 4.5's habit of wrapping up tasks near the context limit.
How did Anthropic cut time to first token by about 90%?
The harness no longer waits for a sandbox container to start before making its first inference call. Anthropic starts the call immediately and spawns a sandbox only when the model needs one. The figure is vendor-reported and the absolute latencies were not published.
Do agents ever hold your credentials?
In this design, no. Outbound calls that need a token go through a proxy that injects the credential before the request reaches the external endpoint or MCP server, so the model never sees the token.
What happens if a sandbox dies mid-task?
The failure returns to the model as a failed tool call, and the model decides whether to start a new sandbox or continue. A dead harness is replaced by a new instance that reads the session event log and resumes from the last event.
Why separate the brain from the hands?
Combining everything in one container makes debugging ambiguous, makes investigation hard when customer data is present, and blocks access to customer networks without peering or shipping the harness. Separating them makes each part replaceable.
What does the environment API control?
It defines the sandbox template: whether networking is unrestricted or restricted to specific domains and MCP servers, and which packages are installed in the container.
Is the append-only session log summarized?
Anthropic stores every event rather than compacting the stream in place. The compaction strategy runs at read time, choosing how much history to place in context, so the stored record stays complete.
Can one agent use several different tools?
Yes. One brain can call a sandbox container, reach into a customer VPC, or call an MCP server. Those hands are interchangeable, and new ones can be added without changing the agent loop.
Why do harness assumptions go stale?
A harness is written around the weaknesses of a specific model, and each new model removes some of those weaknesses. The Sonnet 4.5 context reset became unnecessary with Opus 4.5, so the reset had to be removed rather than carried forward.
Who built this
Priyanka is a member of technical staff at Anthropic leads the engineering team that built Claude Managed Agents; she has been at Anthropic for over two years, with the last 12 months focused on agentic infrastructure. Gabe Semach is a member of technical staff on her team, working on Claude Managed Agents for his entire time at Anthropic little over a year. The material above comes from their AI Engineer workshop, "Decoupling the Brain from the Hands: Claude Managed Agents," which ran as a single two-hour session split into four parts: the architecture story, a no-code console walkthrough, a coding portion using Claude Code or another coding agent, and a Q&A.
The idea that survives the architecture is the one worth keeping: interfaces should be designed to outlast the assumptions inside them. Anthropic harness changed, its compaction strategy changed, and the append-only session log did not. If you have the same kind of knowledge sitting in a YouTube video, a recorded talk or an interview, the same principle applies to publishing it, and Skala Blog turns that video into a written article by transcribing it and drafting the piece for you.
Fork this article
Start a new branch from the same video, shaped your way. You keep the credit; the original keeps the attribution.
A fork in another language is filed as a translation of this article, so the two pages point at each other. You can unlink it later from the editor.
0/240
You are creating
- Format
- For
- Language
- Source
- Your angle
You will be asked to sign in before it is generated.
Buy credits