Evolution of agentic surfaces — Gagan Bhat & Isabella Kai He, Anthropic
Gagan Bhat, Isabella Kai He
31 minAnthropic engineers outline the evolution from simple Messages API to Claude Managed Agents, which package production-grade agent infrastructure. The managed architecture decouples the agent’s “brain” (agentic loop + model) from its “hands” (sandbox) to improve reliability, security, and latency. Core primitives—agent, environment, and durable session with logs—enable long-running, recoverable workflows and observability. Frontier features like dreaming and outcomes aim to deliver self-improving agents and rubric-driven success.
- Evolution of agentic surfaces: Messages API (tokens in/out) → manual agentic loop with heavy infra burden → Claude Agent SDK (built-in loop, FS access, tools, sandbox) → Claude Managed Agents (production infra provided).
- Managed Agents supply the agentic loop (“brain”) and a just-in-time sandbox (“hands”) plus hosting, session management, observability, sandboxing, and credential handling run by Anthropic.
- Harnesses encode assumptions that go stale as models improve; fixes for older behavior can become overhead (e.g., Sonnet 4.5 context anxiety fix became harmful for Opus 4.5).
Read full briefing
Key technical points
- Evolution of agentic surfaces: Messages API (tokens in/out) → manual agentic loop with heavy infra burden → Claude Agent SDK (built-in loop, FS access, tools, sandbox) → Claude Managed Agents (production infra provided).
- Managed Agents supply the agentic loop (“brain”) and a just-in-time sandbox (“hands”) plus hosting, session management, observability, sandboxing, and credential handling run by Anthropic.
- Harnesses encode assumptions that go stale as models improve; fixes for older behavior can become overhead (e.g., Sonnet 4.5 context anxiety fix became harmful for Opus 4.5).
- Architecture decouples brain from hands to improve reliability and allow on-demand sandbox spin-up and retries if the sandbox dies, and session-based recovery if the brain dies.
- Three primitives: agent (model, prompts, tools, skills), environment (container definition; multiple isolated containers per environment), and session (durable, persisted log of all interactions).
- Session states: idle (waiting on input), running (executing), rescheduling (retry after error), terminated (unrecoverable), enabling robust long-running execution and recovery.
- Context engineering via a durable session log lets the harness re-read slices of prior context into the current window and recover discarded context during runs.
- Decoupling reduced latency: the model can start reasoning while container setup runs in parallel, improving time-to-first-token for median and tail cases.
- Credential security: keep secrets away from the agent using vaults; credentials are decrypted only at tool execution time so the model never sees tokens.
- Enterprise security features: self-hosted sandboxes to run tool execution in a customer VPC, and MCP tunnels so MCP servers stay private and only make outbound calls.
- Demo SRE agent: define agent (e.g., SRE Investigator with system prompt, tools like bash/grep/blob, and MCP toolset), define environment (Anthropic cloud, restricted networking, allowlisted MCP host), upload logs/skills, create session, and run with full observability of traces and tool results.
- Managed Agents target long-running, asynchronous, complex tasks, requiring strong context accumulation, secure sandbox action, reliability, and workflow parallelization.
- The harness provides agent loop, memory, and observability; developers focus on domain-specific prompts, skills, tools, and context management.
- Frontier features: dreaming (batch processing transcripts + memory to update memory and self-improve) and outcomes (rubric-driven grader agent that enforces success criteria and triggers retries), plus items like scheduled deployments and multi-agent orchestration.
For AI/software engineers, the talk specifies a modular, production-ready agent architecture: define agents/environments/sessions; rely on a durable session log for recovery and context management; decouple reasoning from execution for reliability and latency; and secure tool execution via vaults, self-hosted sandboxes, and MCP tunnels. It highlights how harness assumptions must adapt to model changes, and surfaces built-in observability and session states to operate long-running agents at scale. Engineers can scope customization to prompts, tools, and domain skills while offloading orchestration and infra to Managed Agents.























