Dora NodaIn April 2026, Anthropic quietly redrew the build-vs-buy line for everyone running coding agents in production. Before the launch of Claude Managed Agents, a team that wanted an agent operating real infrastructure had two jobs: prompt the model, and build everything the model runs inside — sandboxes, session state, credential plumbing, audit trails. After it, one of those jobs is a hosted API call. The question for platform teams is no longer whether the hosted shape works. Notion, Rakuten, and Sentry put it in production within weeks. The question is what it costs to copy the shape on infrastructure you own — and which half of it you should copy at all.
Here is the verdict up front. Anthropic's hosted model and a self-hosted Agent SDK fleet are not two prices for the same thing. They are two different answers to where an agent's state lives:
| Rent the session (Managed Agents) | Own the process (Agent SDK, self-hosted) | |
|---|---|---|
| Caller sends | Events over REST/SSE, gets results back | Prompts into a local query() call |
| Agent runs in | Anthropic-provisioned container per session | Your claude subprocess with a shell, a cwd, and transcript files on your disk |
| Session state | Server-side event log; survives dropped connections | Files keyed by working directory; lose the disk, lose the resume |
| Isolation | Anthropic's per-session sandbox boundary | Whatever you build (Docker, K8s, gVisor, microVM) |
| Meter | ~$0.08 per active session-hour + tokens | Your compute + the same tokens |
| Code and secrets live | On Anthropic's infrastructure | On yours |
The rest of this post earns that table: what each shape concretely runs for you, the five platform bills compared side by side, the worked cost math (spoiler: the $0.08 line item is not the one that matters), and the roadmap recommendation for a self-hosted PaaS — steal the session-API shape, keep the fleet underneath it.
The hosted shape: what Managed Agents actually runs for you
Claude Managed Agents entered public beta on April 8, 2026 behind the managed-agents-2026-04-01 beta header, as a set of composable resources: agents (prompt, tools, guardrails), environments (where sessions run), and sessions (the unit of work, driven by events). Anthropic runs the orchestration harness — the loop that calls tools, manages context, and handles errors — and provisions a sandboxed container per session with bash, file operations, code execution, your files and repos mounted in, web search, and MCP server connections. Sessions can run autonomously for hours, and results persist even if your connection drops.
Anthropic's headline claim is a tenfold cut in prototype-to-production time, and the early customer list gives it weight: Notion delegates workspace tasks to Claude directly, Rakuten stood up Slack- and Teams-connected enterprise agents for sales, marketing, and finance in about a week each, and Sentry pairs a debugging agent with one that writes patches and opens pull requests.
Three properties of the hosted shape matter more than the feature list.
First, environments come in two flavors: Anthropic-cloud or self-hosted. You can register your own sandbox as an environment and have Managed Agents drive it — Anthropic designed the escape hatch itself, which tells you the hosted-only story was never meant to cover every workload.
Second, credentials flow through vaults. GitHub tokens and integration secrets are injected per client rather than pasted into prompts, which is the correct shape — but community implementations note the edges: a documented cap around twenty credentials per vault, and environment-variable credential substitution that does not extend to self-hosted sandboxes. The vault model is right; its limits are where a self-hosted platform starts to see daylight.
Third, every session event is persisted server-side and retrievable through the API — your audit trail for free, with one catch: no public redaction or retention controls are documented for those traces. Anything the agent saw, touched, or leaked into the transcript sits on Anthropic's infrastructure under Anthropic's retention policy. For a support chatbot that is fine. For an agent with production shell access, that sentence should make you pause, because it is the entire data-plane argument for self-hosting in one paragraph.
The self-hosted shape: what one SDK session really costs you
The Claude Agent SDK looks deceptively simple — query() in, streamed messages out — but architecturally it is the opposite of the hosted shape. Every query() call spawns a claude CLI subprocess (bundled with the SDK, no separate install) that owns a shell, a working directory, and session files on local disk. One agent session maps to one long-lived process. Ten concurrent sessions means ten process trees, each holding its memory footprint whether the agent is thinking, acting, or idle. Session resume is keyed by working directory: the SDK encodes the cwd into its storage key, so resuming means coming back to the same directory on the same disk.
Anthropic's own hosting guidance walks through Docker, Kubernetes, and third-party sandbox providers precisely because the SDK ships no isolation of its own — separate filesystems per session are your job, via distinct working directories at minimum and real sandboxing in production.
That gives you the honest resource math and the five bills a platform team inherits the moment it self-hosts:
- Session persistence. Transcript files on local disk. If the node dies, the disk fills, or the deploy restarts the container mid-loop, the multi-step build-debug session dies with it — unless you built backup, restore, and resume yourself.
- Per-tenant isolation. Out of the box, sessions differ by directory. Running untrusted tenant agents on shared machines needs a real boundary — containers at minimum, gVisor, Kata, or Firecracker microVMs if you mean it — all wired, imaged, and patched by you.
- Resource ceilings and idle cost. Each session holds a process and its memory for its whole lifetime. Without pooling, pre-warming, and reaping, concurrency scales your RAM bill linearly and idle sessions burn money standing still. The community's multi-instance guides converge on the same answer: a pool of pre-warmed instances with per-session directories, which is a small scheduler you now own.
- Credential injection. The SDK inherits your process environment, so secrets reach the agent through env vars and files you manage — along with the risk that anything in the working directory, transcript, or tool output can carry them somewhere they should not go. The clean pattern is a secret proxy (tokens never enter the sandbox), but that proxy is yours to build.
- Audit and retention. Your logs, your retention policy, your redaction — total control, total responsibility. An operator investigating a production change needs the full deploy-and-shell trail, and nobody generates it for you.
None of this is an argument against self-hosting. It is the actual price tag, itemized, so the comparison in the next section is mechanism against mechanism instead of marketing against vibes.
The five platform bills, side by side
| Bill | Managed Agents (hosted) | Agent SDK (self-hosted) | Own-fleet sandboxes (E2B-style, your nodes) |
|---|---|---|---|
| Session persistence across multi-step loops | Server-side event log; survives disconnects, retrievable via API | Transcript files on disk, cwd-keyed; you build backup/resume | PVC-backed workspaces or snapshot/restore; you pick the mechanism per pool |
| Per-tenant isolation | Anthropic's per-session container; you trust their boundary | None built in; you add Docker/K8s/gVisor/microVM | Your choice per pool — Kata, Firecracker, gVisor — with your patching cadence |
| CPU/RAM ceilings, scale-to-zero | Metered on active runtime only; Anthropic absorbs idle | N sessions = N processes; you build pooling and reaping | Warm pools + snapshots; you pay the utilization math, you keep the savings |
| Secrets and credentials | Vaults with per-client injection; caps and self-hosted gaps documented by the community | Env passthrough; you build the secret proxy | Secret proxy pattern; tokens never enter the sandbox |
| Audit and retention | Server-side traces included; no public redaction/retention controls | Your logs, your policy, your work | Your logs plus the deploy-and-shell trail your operators actually need |
Two rows decide most evaluations. The persistence row is the operational heart of the TODO's promise: a deploy-operating agent's value lives in the middle of a thirty-minute build-debug loop, and whoever holds the session state holds the loop. The audit row is the compliance heart: hosted traces are convenient until the transcript contains a production credential, at which point "retrievable via API" cuts both ways.
The money and the data plane
Now the worked example. Take a concrete, typical workload: a deploy-operating agent running thirty-minute build-debug loops, ten loops a day. That is five active session-hours daily.
On Managed Agents, the session meter reads 5 × $0.08 = $0.40/day, roughly $12/month. The token bill for ten half-hour coding sessions at Sonnet-class rates lands around $20/day, roughly $600/month — and that token figure is nearly identical whichever shape you choose, because the model does the same work either way. The hosted session fee is about two percent of the total. Triple the session length and it is still single digits.
The $0.08 number that names the pricing page never decides the deal; anyone comparing "hosted vs self-hosted" on the session fee is comparing the tip and ignoring the iceberg.
On your own fleet, the same five hours against amortized sandbox slots at roughly $0.01–0.03 per slot-hour (the owned-fleet row from this site's 26-provider sandbox survey) costs $0.05–0.15/day plus the same $20 in tokens. Self-hosting the sandbox saves about a quarter per day in absolute terms — real money at fleet scale, noise at team scale.
The honest sensitivity analysis: utilization moves the needle more than the meter rate. The survey's crossover math puts the rent-vs-own flip at roughly 15–25% slot utilization; below it, rented idle capacity is cheaper than owned idle capacity, and the SDK's hold-memory-while-idle process model is what pushes small fleets below that line. Fix idle — pools, snapshots, scale-to-zero — and the owned math wins by multiples.
So if money does not decide it, what does? The data plane. Three checklist questions settle more evaluations than any spreadsheet:
- Where does tenant code execute? Anthropic's cloud, or machines you own. Regulated tenants and security reviews answer this one for you.
- Where do secrets live, and who can read the transcript? Vault-injected on hosted with server-side trace persistence you cannot redact, versus your own proxy and your own retention.
- Who pages when the sandbox breaks? Anthropic's status page, or your on-call. The hosted shape converts engineering headcount into a per-hour fee; at small team sizes that trade is usually worth it, and it inverts somewhere around the point where you already run a fleet team.
The recommendation: steal the API shape, keep the fleet
For a self-hosted PaaS with agent sandboxes on the roadmap, the answer the evidence points to is not either shape as shipped — it is Managed Agents' interface over your own fleet's machinery.
Ship a stateless session API in front: callers send events and receive results, sessions are addressable resources with server-side logs, credentials inject through vault-style per-tenant stores rather than environment-variable sprawl. That interface is the part Anthropic got right — it is what makes agents composable for tenants, what Cloudflare's interop layer independently converged on with durable fibers and MicroVM snapshots, and what the open-source Managed-Agents-compatible projects are already cloning. An interface tenants can program against outlives any single sandbox engine.
Run fleet-owned sandboxes behind it: per-session Firecracker or Kata microVMs on Cluster API-managed pools, PVC-backed workspaces so a build-debug loop survives eviction, warm pools with snapshot resume so cold start stays near a hundred milliseconds, and a secret proxy so tokens never enter the sandbox. That is the part of the hosted shape you must not rent forever — the persistence, isolation, and audit rows all read better when the disk, the kernel boundary, and the log retention are yours.
And keep the escape hatch Anthropic itself legitimized: let a tenant's session target their own environment when their compliance story demands it. Self-hosted environments in the Managed Agents API prove the hybrid pattern is not a compromise — it is the design.
One scope limit, stated plainly: this is the roadmap for agents that operate deploys — build loops, debug sessions, rollout supervision. Agents that train models want gang scheduling, queue fairness, and GPU topologies, which is a different scheduler conversation entirely.
The deepest lesson of the April launch is not a price or a protocol. It is that the session — a persistent, auditable, credential-scoped unit of agent work — is now the platform primitive, the way the container was a decade ago. Whoever runs the session layer runs the agent platform. The only remaining question is whether that layer runs on your machines or someone else's.
Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.
