Claude Agents Move Into Company Infrastructure — Two London Reveals
Anthropic held its London keynote yesterday, and two features landed on Managed Agents. You can now run Claude agents without ever sending your code and files outside the corporate network. This release lifts part of the adoption wall that had blocked fintech and enterprise teams.
- Self-hosted Sandbox — Public Beta
- MCP Tunnels — Research Preview
- Enterprise, announced 5/19
01 · What Changed: Tool execution moved from Anthropic to your own infrastructure
Until now, Managed Agents ran everything — tool execution and file handling — on Anthropic's infrastructure. Your company code had to be pushed to an external network at least once. This release splits off that execution layer.
| Before | After (5/19 London) | |
|---|---|---|
| Where it runs | Anthropic net (orchestration + tool execution + files) | Your infra (tool execution + files stay inside the customer network) |
| Code exposure | Required | None |
| Internal DB / MCP access | Impossible | Internal MCP server connection possible |
| Fintech adoption | Blocked | Orchestration stays on Anthropic |
02 · Self-hosted Sandbox: Tools run inside your network — Public Beta
This option places the sandbox where the agent's code execution and file work happen inside the customer's own infrastructure. Sensitive files, packages, and services never leave the network. If running it yourself is a burden, you can use one of four Anthropic-certified managed providers.
Managed sandbox providers (Public Beta):
- Cloudflare — sandbox hosted on Workers plus its own container runtime. Global edge network, low latency.
- Daytona — isolated workspaces purpose-built for dev environments. Strong at per-repo isolation.
- Modal — Python serverless with automatic GPU/CPU scaling. Fits data and ML workloads.
- Vercel — frontend/full-stack build context. Smooth for teams already on Vercel.
Between self-hosting and the four managed options, even teams with strict internal security reviews now have a path. Since it's Public Beta, larger policy changes are still possible.
03 · MCP Tunnels: Connect internal MCP servers with zero external exposure
The second feature is MCP Tunnels. It lets Claude agents call MCP servers sitting inside your internal network without any inbound firewall rules. A gateway opens just a single outbound connection, and an end-to-end encrypted tunnel runs over it.
The old problem (pre-5/19):
"To attach an internal DB or issue-tracker MCP to Claude, you needed a public endpoint."
Root cause: calling an MCP server from outside required opening an inbound port plus an auth gate. The security team blocking it was the correct behavior. A workaround was, in the end, still a workaround.
How MCP Tunnels change the math:
- 1 outbound connection — single one-way
- 0 inbound firewall rules — no new openings
- E2E encryption — end-to-end encrypted
- Research Preview — apply via form
Access is by form application — not instantly available, which is the difference from the Public Beta Sandbox. For teams whose biggest hurdle was convincing the security team, it's one more architecture card to play.
04 · Position: Not everything is unblocked — orchestration is still external
The agent loop, context management, and error handling still run on Anthropic's network. A fully air-gapped on-prem deployment is not part of this release.
| Inside customer network | Inside Anthropic network |
|---|---|
| Tool execution · files · MCP server calls | Agent loop · prompts · model inference |
Some financial institutions have policies that forbid "the prompt itself being sent to an external model." This release doesn't move that policy line. The structure is still "the code doesn't leave, but the instructions do" — so some teams have to wait one more release.
05 · Eddie's Note
"A signal that the axis of enterprise AI competition is shifting from model performance to the deployment boundary."
— Eddie · 2026.05.20
A blocked adoption wall has been partly lifted. "Code stays inside the company, inference happens outside" is becoming the new default.
References
Anthropic official
- claude.com/blog — Self-hosted sandboxes and MCP tunnels (2026.05.19)
- claude.com — Code with Claude London 2026.05.19
Coverage
- The Decoder — Anthropic adds self-hosted sandboxes and MCP tunnels
- 9to5Mac — privacy and security features
Disclaimer: A summary of Anthropic's official announcement. No ads, no affiliate links. Not based on my own hands-on use — objective recap.
Original with full infographics and visual structure: https://jessinvestment.com/claude-agents-move-into-company-infrastructure-two-london-reveals/
