Anthropic’s newest flagship, Claude Fable 5.1, shipped on September 1, 2026, alongside a feature that changes how developers actually deploy it: Claude Managed Agents. Instead of writing your own agent loop, wiring up a sandbox, and babysitting tool-call retries, you hand Anthropic the harness and get back a hosted session that reads files, runs bash commands, browses the web, and streams results over server-sent events. It has been in public beta since April 8, 2026, and Anthropic has reported Claude’s SWE-bench Verified score climbing from 62% on Sonnet 3.7 to 87% on Opus 4.7 as of May 2026 — pairing that benchmark trajectory with Fable 5.1’s coding and long-horizon results is what has developers searching for a working setup right now. The lineup kept moving from there: Claude Opus 5 arrived in August 2026 with its own 1-million-token context window and a 128K-token maximum output, and by October 2026 Claude Sonnet 5.5 had taken over as the default Sonnet model, carrying the same 1-million-token context window at $2/$10 per million input/output tokens.
This tutorial walks through standing up a working Claude Managed Agents deployment from a blank terminal: creating an agent, provisioning a sandboxed environment, starting a session, streaming events, wiring in a GitHub repository, adding a scheduled deployment, and reading the bill afterward. Every code sample below matches the current Claude Platform API reference and the official quickstart, and every price comes from Anthropic’s published pricing page as of September 8, 2026.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Claude Managed Agents actually is
Anthropic now offers two distinct paths for building with Claude. The Messages API gives you direct model prompting: you send a prompt, get a completion, and if you want multi-step tool use you write the orchestration loop yourself. The Claude Agent SDK, the library that powers Claude Code, lets you run that same loop inside your own process on your own infrastructure. Claude Managed Agents is the third option, and it flips the ownership model entirely: Anthropic runs the harness, the sandbox, and the session storage, and you talk to it over a REST API.
Practically, that means when a session receives a user message, four things happen automatically. Anthropic provisions a sandbox according to your environment config. Claude runs its agent loop and decides which tools to call. Tool calls, whether that is a bash command, a file write, or a web fetch, execute inside that sandbox. And every step streams back to you as a server-sent event, so your application can render progress in real time instead of polling for a final answer.
Anthropic positions Managed Agents for long-running execution (tasks that run for minutes or hours across many tool calls), stateful sessions with persistent filesystems, and scheduled recurring runs. If you need fine-grained control over every step of your agent loop, the Agent SDK remains the better fit. If you want a production agent without building sandboxing and tool execution yourself, Managed Agents is the faster path.
| Approach | Who runs the loop | Where state lives | Best for |
|---|---|---|---|
| Messages API | You | Your infrastructure | Custom orchestration, simple completions |
| Claude Agent SDK | You (via library) | Your infrastructure | Fully custom agents, same loop as Claude Code |
| Claude Managed Agents | Anthropic | Anthropic infrastructure | Hosted production agents, scheduled jobs, async work |
Prerequisites and versions
Before starting, confirm you have the following in place. Version numbers matter here because Managed Agents is still in public beta and its request format is gated behind a beta header that changes as the feature matures.
- A Claude Console account at platform.claude.com with billing enabled
- An active Claude API key generated from Settings > Keys
- Python 3.10 or later, or Node.js 18 or later, if you plan to use an SDK instead of raw curl
- The
anthropicPython package (install withpip install anthropic) or@anthropic-ai/sdkfor TypeScript (install withnpm install @anthropic-ai/sdk) - The
antCLI, version 1.29.0 or later, for the config-file workflow (optional but recommended for reusable agent definitions) jqinstalled locally if you’re following the curl examples, to parse JSON responses in shell- A GitHub personal access token if you want to mount a repository into a session (Step 9)
One thing to flag before you write a single line of code: Managed Agents is not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement coverage, because sessions are stateful by design and store conversation history, sandbox state, and outputs server-side. If your workload has strict data-residency or compliance requirements, read Anthropic’s API and data retention documentation before committing to this architecture.
Step 1: Install the CLI and SDK
Start by installing the ant CLI, which lets you version-control agent and environment definitions as YAML or Markdown files instead of hand-rolling curl calls every time. On macOS, use Homebrew. On Linux or WSL, pull the release binary directly.
# macOS
brew install anthropics/tap/ant
# Linux/WSL
VERSION=1.29.0
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
case $(uname -m) in
x86_64) ARCH=amd64 ;;
aarch64) ARCH=arm64 ;;
esac
curl -fsSL "https://github.com/anthropics/anthropic-cli/releases/download/v${VERSION}/ant_${VERSION}_${OS}_${ARCH}.tar.gz" \
| sudo tar -xz -C /usr/local/bin ant
ant --versionThen install the SDK for whichever language you’ll drive the API from. Both official SDKs set the required beta header automatically, which saves you from a common source of 400 errors described in the troubleshooting section below.
# Python
pip install anthropic
# TypeScript
npm install @anthropic-ai/sdk
# Set your key
export ANTHROPIC_API_KEY="your-api-key-here"Step 2: Understand the four core resources
Every Managed Agents request revolves around four objects, and getting the mental model straight up front saves you from mixing them up once the JSON gets more complex.
| Resource | What it holds |
|---|---|
| Agent | The model, system prompt, tools, MCP servers, and skills. Created once, referenced by ID across many sessions. |
| Environment | Where sessions run: an Anthropic-managed cloud sandbox, or a self-hosted sandbox on your own infrastructure. |
| Session | A running agent instance inside an environment, performing a specific task and producing outputs. |
| Events | Messages exchanged between your app and the agent: user turns, agent responses, tool calls, tool results, and status updates. |
Beyond those four, the API also exposes Session Resources (for mounting a GitHub repo or files into a session), Session Threads (for multiagent coordination), Vaults and Credentials (for storing secrets an agent can use, like OAuth tokens for MCP servers), Memory Stores (for cross-session persistence), and Deployments (for cron-scheduled runs). Managed Agents entered public beta in April 2026 behind the versioned managed-agents-2026-04-01 API header, and Anthropic scoped that first release to six capabilities — memory, tools, MCP, Skills, web search, and code execution — pitched around cloud-hosted agents with managed state, memory, permissions, and scheduled execution. You’ll touch most of those six, now backed by this fuller resource model, before this tutorial is done.
Step 3: Create your first agent
An agent definition bundles the model, system prompt, and tool access. Every Managed Agents endpoint requires the managed-agents-2026-04-01 beta header, the same header Anthropic documented when it published the Managed Agents beta in April 2026 (memory store endpoints use a different one, agent-memory-2026-07-22, which trips people up more than any other detail in this API). The SDKs attach the header for you; if you’re using raw curl, you have to add it manually.
agent=$(
curl -sS --fail-with-body https://api.anthropic.com/v1/agents \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "anthropic-beta: managed-agents-2026-04-01" \
-H "content-type: application/json" \
-d @- <<'EOF'
{
"name": "Coding Assistant",
"model": "claude-opus-5",
"system": "You are a helpful coding assistant. Write clean, well-documented code.",
"tools": [
{"type": "agent_toolset_20260401"}
]
}
EOF
)
AGENT_ID=$(jq -er '.id' <<<"$agent")
AGENT_VERSION=$(jq -er '.version' <<<"$agent")
echo "Agent ID: $AGENT_ID, version: $AGENT_VERSION"Or in Python, using the SDK, which is what the rest of this tutorial standardizes on:
from anthropic import Anthropic
client = Anthropic()
agent = client.beta.agents.create(
name="Coding Assistant",
model="claude-opus-5",
system="You are a helpful coding assistant. Write clean, well-documented code.",
tools=[
{"type": "agent_toolset_20260401"},
],
)
print(f"Agent ID: {agent.id}, version: {agent.version}")The agent_toolset_20260401 type enables the full pre-built agent toolset in one line: bash execution, file read/write/edit/glob/grep, and web search and fetch. If you want narrower tool access, or you want to swap in Claude Fable 5.1 for tasks that benefit from its higher coding and agentic scores, change the model field. Model support has grown considerably since Managed Agents launched in April 2026 with just two models, Opus 4.7 and Sonnet 4.6; Fable 5.1 is now fully supported alongside the rest of the current lineup. Claude Opus 5, which launched in August 2026, carries that same 1 million-token context window plus a 128K-token maximum output, and as of October 2026 Claude Sonnet 5.5 has replaced Sonnet 5 as the default Sonnet model, matching that 1 million-token window at $2/$10 per million input/output tokens.
Step 4: Create an environment
An environment defines the sandbox your sessions run inside. For most workloads, a cloud sandbox with unrestricted networking is the fastest path to a working demo. For production workloads that touch internal systems, restrict networking or move to a self-hosted sandbox on your own infrastructure.
environment = client.beta.environments.create(
name="quickstart-env",
config={
"type": "cloud",
"networking": {"type": "unrestricted"},
},
)
print(f"Environment ID: {environment.id}")Save both agent.id and environment.id. You reference both every time you start a new session, and if you used ant apply instead of the SDK, both are recorded automatically in a local claude-lock.json file for version control.
Step 5: Start a session
A session is a running instance of your agent inside your environment. Creating one is cheap and fast; the sandbox itself only provisions once you actually send a message.
session = client.beta.sessions.create(
agent=agent.id,
environment_id=environment.id,
title="Quickstart session",
)
print(f"Session ID: {session.id}")Step 6: Send a message and stream the response
This is where Managed Agents earns its keep. Open the event stream first, then send the user message, then process events as they arrive. Getting the order backwards (sending the message before the stream opens) is one of the most common early mistakes, covered in the pitfalls section below.
with client.beta.sessions.events.stream(session.id) as stream:
# Send the user message after the stream opens
client.beta.sessions.events.send(
session.id,
events=[
{
"type": "user.message",
"content": [
{
"type": "text",
"text": "Create a Python script that generates the first 20 "
"Fibonacci numbers and saves them to fibonacci.txt",
},
],
},
],
)
for event in stream:
match event.type:
case "agent.message":
for block in event.content:
print(block.text, end="")
case "agent.tool_use":
print(f"\n[Using tool: {event.name}]")
case "session.status_idle":
print("\n\nAgent finished.")
breakRun that and the sandbox provisions, Claude writes the script, executes it with the bash tool, and verifies the output file exists before reporting back. A typical run looks like this:
I'll create a Python script that generates the first 20 Fibonacci numbers and saves them to a file.
[Using tool: write]
[Using tool: bash]
The script ran successfully. Let me verify the output file.
[Using tool: bash]
fibonacci.txt contains the first 20 Fibonacci numbers (0 through 4181).
Agent finished.The five things happening under the hood, in order: Anthropic provisions the sandbox per your environment config, the agent loop decides which tools to call, tool calls execute inside the sandbox, results stream back over SSE, and the session emits session.status_idle once there's nothing left to do. Event history persists server-side, so you can fetch the full transcript later even if your client disconnects mid-stream.
Step 7: Steer or interrupt a running session
Managed Agents sessions are designed to be steerable mid-execution, not just fire-and-forget. Send another user.message event to the same session while it's still running, and the agent incorporates it on its next turn without losing prior context.
client.beta.sessions.events.send(
session.id,
events=[
{
"type": "user.message",
"content": [
{"type": "text", "text": "Actually, add type hints to the script before saving it."}
],
}
],
)This matters for anything longer than a single-shot task: code review agents that need a human to approve a risky bash command, research agents that need a redirect halfway through, or support agents that need an escalation path. Persistent filesystems and conversation history across interactions are one of Anthropic's stated reasons to reach for Managed Agents over a DIY loop in the first place.
Step 8: Define a measurable outcome
For tasks with a clear success condition, send a user.define_outcome event instead of (or in addition to) a plain message. This gives the agent a rubric to check its own work against and caps how many iterations it will take trying to satisfy it.
client.beta.sessions.events.send(
session.id,
events=[
{
"type": "user.define_outcome",
"description": "Build a DCF model for Costco in .xlsx",
"rubric": {"type": "file", "file_id": "file_01ABC..."},
"max_iterations": 5,
}
],
)This is the mechanism behind Anthropic's "dreaming" research preview and behind self-checking agent patterns generally: instead of trusting the model's own claim that it's done, you give it an explicit rubric (a file, a test suite, a checklist) and a hard iteration ceiling so a stuck agent doesn't burn session-hours in a loop.
Step 9: Mount a GitHub repository into a session
Most real coding-agent use cases need a live repo in the sandbox, not just a scratch filesystem. Pass a resources array when you create the session, specifying a GitHub URL, an auth token, a mount path, and which branch to check out.
session = client.beta.sessions.create(
agent=agent.id,
environment_id=environment.id,
title="Fix the auth module",
resources=[
{
"type": "github_repository",
"url": "https://github.com/your-org/your-repo",
"authorization_token": "ghp_your_token_here",
"mount_path": "/workspace/repo",
"checkout": {"type": "branch", "name": "main"},
}
],
initial_events=[
{
"type": "user.message",
"content": [{"type": "text", "text": "Review the auth module for injection risks."}],
}
],
)Notice the initial_events field: you can seed a session with its first user message at creation time instead of sending it as a separate event after the fact. This is the pattern the official Chat SDK, assistant-ui, and CopilotKit quickstarts all use to spin up one session per conversation thread.
Step 10: Add secrets with vaults and credentials
If your agent needs to authenticate to an MCP server or an external API, don't hardcode tokens into the system prompt. Create a vault, add a credential to it, and reference the vault ID when you create a session.
vault = client.beta.vaults.create(name="production-secrets")
credential = client.beta.vaults.credentials.create(
vault_id=vault.id,
name="github-mcp-token",
value="ghp_your_token_here",
)
session = client.beta.sessions.create(
agent=agent.id,
environment_id=environment.id,
vault_ids=[vault.id],
)Credentials support an OAuth validation endpoint too, useful if your agent connects to an MCP server that requires an OAuth handshake rather than a static token. Vaults are scoped separately from agents and environments, so the same vault can back multiple agents without duplicating secrets.
Step 11: Connect an MCP server
Agents aren't limited to the built-in toolset. Add an mcp_servers array to your agent definition to give it access to any Model Context Protocol server, whether that's GitHub, a database, or an internal tool you've written yourself.
agent = client.beta.agents.create(
name="Repo Assistant",
model="claude-fable-5.1",
system="You help maintain this repository. Use the GitHub MCP server for issue and PR operations.",
tools=[{"type": "agent_toolset_20260401"}],
mcp_servers=[
{
"type": "url",
"name": "github",
"url": "https://api.githubcopilot.com/mcp/",
}
],
)If you have already built and tested a set of tools with the Claude Agent SDK or a standalone MCP server, this is the fastest way to reuse that work inside a hosted agent instead of rewriting it. If you haven't set up an MCP server before, the site's dedicated MCP server tutorial walks through building one from scratch with FastMCP.
Step 12: Schedule a recurring deployment
For agents that should run on a cron schedule rather than in response to a user action, create a deployment. Anthropic handles triggering the session automatically; you don't run a scheduler yourself.
deployment = client.beta.deployments.create(
name="Weekly compliance scan",
agent=agent.id,
environment_id=environment.id,
initial_events=[
{"type": "user.message", "content": [{"type": "text", "text": "Run the weekly scan."}]}
],
schedule={
"type": "cron",
"expression": "0 20 * * 5",
"timezone": "America/New_York",
},
budget={"type": "limit", "max_list_cost": {"amount": "5000", "currency": "USD"}},
)The budget field is worth setting on every deployment you ship to production. It caps total spend across runs, which is the single best guardrail against a misconfigured cron expression or a runaway agent quietly burning through session-hours over a long weekend. Anthropic sharpened that guardrail in August 2026, when Managed Agents sessions gained configurable hard spending caps billed at public list rates, so a deployment that hits its ceiling stops outright rather than just flagging the overage after the fact. You can pause, unpause, or manually trigger a deployment at any time through /v1/deployments/{deployment_id}/pause, /unpause, and /run.
Reading session history, outcomes, and deleting data
Once a session goes idle, the work isn't lost the moment your client disconnects. Event history persists server-side, so you can fetch the full transcript of what an agent did, in what order, and with what tool results, at any point after the fact. That matters for audit trails on anything that touched production data, and it's also the fastest way to debug a session that produced an unexpected result without having to reproduce it live.
# List every event in a completed session, oldest first
events = client.beta.sessions.events.list(session.id, order="asc")
for event in events:
print(event.type, getattr(event, "name", ""))
# Fetch a single session's metadata, including status and outcome
session_detail = client.beta.sessions.get(session.id)
print(session_detail.status)
# Delete a session and its stored history when you're done with it
client.beta.sessions.delete(session.id)Because Managed Agents sessions are excluded from Zero Data Retention, deleting sessions yourself is the main lever you have for controlling how long that history sticks around. The same applies to any files you upload into a session: deleting the session doesn't automatically delete files referenced inside it, so clean those up separately through DELETE /v1/files/{file_id} if a task involved uploading documents or spreadsheets. For teams running scheduled deployments, build a retention job that walks completed sessions on a cadence and deletes anything past your internal data-handling policy, rather than relying on manual cleanup.
How Managed Agents compares to DIY agent frameworks
Developers evaluating Managed Agents are usually coming from one of two places: either they've already built an agent loop with an open-source framework like LangGraph, CrewAI, or AutoGen, or they're starting fresh and trying to decide where to invest engineering time. The honest comparison isn't "which is better" so much as "who do you want operating the parts that break."
DIY frameworks give you full control over orchestration logic, memory strategy, and tool routing, but you own the sandbox, the retry logic, the state persistence layer, and the infrastructure that keeps a long-running agent alive across restarts. That's a reasonable tradeoff if your team already runs Kubernetes clusters and wants an agent that's just another workload in that fleet. It's a much bigger lift if you're a two-person team trying to ship an agent-backed feature this quarter.
Managed Agents trades some of that control for speed to production: sandboxing, session persistence, event streaming, and scheduled execution all come built in, and Anthropic's own framing, "get to production 10x faster," reflects that pitch directly. Anthropic has kept shipping against that pitch since launch — it announced three new Managed Agents features at its developer event in May 2026, as reported by 9to5Mac — so the feature gap between the hosted harness and a DIY loop keeps narrowing. The cost is that you're bound to Anthropic's infrastructure and pricing model rather than choosing your own compute, and, as of this writing, you give up ZDR and HIPAA BAA eligibility that some DIY setups on your own infrastructure can preserve. For teams already committed to Claude as their model provider and not tied to a specific self-hosted framework, Managed Agents is generally the faster starting point; you can always migrate specific workloads to the Agent SDK later if you outgrow the hosted harness.
Understanding the billing model
Managed Agents billing has two dimensions: tokens and session runtime. Tokens are billed at the same per-model rates as the Messages API, with prompt caching multipliers applying identically — Claude Sonnet 5's introductory $2-per-million-input/$10-per-million-output pricing, for instance, became Anthropic's permanent rate in August 2026 rather than reverting upward after launch. Session runtime is billed separately at $0.08 per session-hour, the same rate Anthropic published alongside the April 2026 beta launch, metered to the millisecond, and only while the session's status is running. Time spent idle (waiting on your next message), rescheduling, or terminated doesn't count. This session-runtime charge replaces the old code-execution container-hour billing model, so you're not paying for both.
| Model | Input | Output | Cache hit | Context window |
|---|---|---|---|---|
| Claude Fable 5.1 | $10 / MTok | $50 / MTok | $0.25 / MTok (0.025x) | 1M tokens |
| Claude Mythos 5.1 | $10 / MTok | $50 / MTok | $0.25 / MTok (0.025x) | 1M tokens |
| Claude Opus 5 | $5 / MTok | $25 / MTok | $0.50 / MTok (0.1x) | 1M tokens |
| Claude Sonnet 5 | $2 / MTok | $10 / MTok | $0.20 / MTok (0.1x) | 200K tokens |
| Claude Sonnet 4.6 | $3 / MTok | $15 / MTok | $0.30 / MTok (0.1x) | 1M tokens |
| Claude Haiku 4.5 | $1 / MTok | $5 / MTok | $0.10 / MTok (0.1x) | 200K tokens |
Fable 5.1 and Mythos 5.1 get a steeper cache-hit discount than every other current model, 0.025x base input price instead of the standard 0.1x, which works out to $0.25 per million tokens on a cache hit versus $1 per million on the prior-generation Fable 5. For a repo-mounted coding agent that re-reads the same large system prompt and file tree on every turn, that discount compounds fast.
Anthropic publishes a worked example: a one-hour coding session on Claude Opus 5 that consumes 50,000 input tokens and 15,000 output tokens costs $0.25 for input, $0.375 for output, and $0.08 for the session-hour, totaling $0.705. Turn on prompt caching so 40,000 of those input tokens are cache reads instead of fresh input, and the same session drops to $0.525. For Fable 5.1 at its higher per-token rate, the same workload runs roughly $1.13 uncached given the $10/$50 pricing, though the deeper cache discount narrows that gap on repeat-heavy sessions.
Web search triggered inside a session bills at the standard $10 per 1,000 searches on top of token costs, and code execution runs free when it's used alongside web search or web fetch. Outside that pairing, code execution is billed by time instead of tokens, with a minimum of 5 minutes per invocation, 1,550 free organization-wide hours per month, and $0.05 per hour per container beyond that. In practice, most agent sessions built with agent_toolset_20260401 won't hit that separately, since session-runtime billing already covers the sandbox the code runs in; it mainly applies if you're calling code execution as a standalone server-side tool outside a Managed Agents session.
Track spend as you go rather than waiting for a monthly invoice to surprise you. The Claude Console shows a real-time cost breakdown per agent and per session, and the Rate Limits API lets you query your organization's and workspace's current limits programmatically, which is worth wiring into a dashboard if you're running more than a handful of agents. For teams on Claude Platform on AWS, the same token and runtime charges convert to Claude Consumption Units at $0.01 per CCU and show up as a single line item on your AWS bill, with AWS Cost Explorer providing the aggregated view.
5 common pitfalls to avoid
1. Forgetting the beta header on raw HTTP requests. Every Managed Agents endpoint requires anthropic-beta: managed-agents-2026-04-01, except memory store endpoints, which use agent-memory-2026-07-22 instead. Miss it and you'll get a 400 invalid_request_error, not a helpful "wrong beta header" message. The official SDKs set this automatically, which is the strongest argument for not hand-rolling curl in production code.
2. Sending the user message before opening the event stream. The API expects you to open the stream connection first, then send the event. Reverse the order and you can silently miss the early events, including the agent's first tool calls, because there was nothing listening yet.
3. Treating Managed Agents as HIPAA- or ZDR-eligible. Because sessions persist conversation history, sandbox state, and outputs server-side by design, Managed Agents is explicitly excluded from Zero Data Retention and HIPAA Business Associate Agreement coverage as of this writing. If your use case needs either, you'll need to build on the Messages API or Agent SDK instead, or wait for expanded eligibility.
4. Skipping the budget field on scheduled deployments. A deployment with no budget set has no spend ceiling. Combined with a cron schedule, an agent that gets stuck retrying a failing step (a documented failure mode where agents will "execute first, ask never" by default) can run up real cost before anyone notices. Set max_list_cost on every deployment you ship.
5. Confusing session-hour billing with wall-clock time. Session runtime only accrues while status is running, not while it's idle waiting on you. But if you leave a session open and keep sending sparse messages over hours, check whether your session is actually going idle between turns or staying in a running state; a session that never settles to idle bills the full duration even during long silent stretches.
Advanced tips
Run multiple agents in coordination
The multiagent field on an agent definition lets you set one agent as a coordinator that assigns subtasks to other agents and merges their results, tracked as separate session threads. This mirrors the sub-agent pattern in Claude Code but runs entirely server-side, which is useful when you want parallel research or parallel code review without managing multiple client connections yourself.
Use self-hosted sandboxes for compliance
If a cloud sandbox doesn't satisfy your data-residency requirements, set config.type to self_hosted on your environment instead of cloud. The agent still runs through the managed API and event stream, but tool execution happens on infrastructure you control. This is the path Anthropic recommends for regulated workloads that can't use ZDR-ineligible cloud sandboxes.
Pin inference geography if you need US-only routing
Setting model.inference_geo to "us" on an agent keeps token processing inside the United States, at a 1.1x pricing multiplier on top of standard rates. This applies identically to Managed Agents sessions as it does to direct Messages API calls, and it's the mechanism to use if a customer contract requires US-only inference rather than the global default.
Reserve fast mode for latency-sensitive Opus workloads
Setting an agent's model.speed to "fast" triggers fast-mode pricing, currently a research preview available on Claude Opus 5 and Opus 4.8 only, billed at $10 per million input tokens and $50 per million output tokens across the full context window. It's not available on Fable 5.1, Opus 4.7, or Opus 4.6. Use it selectively for interactive agents where perceived latency matters more than raw cost, not for background deployments.
Complete working project: a repo review agent
Putting the pieces together, here's a self-contained script that creates an agent, an environment, mounts a repository, asks for a security review with a bounded iteration count, and streams the result to your terminal.
import os
from anthropic import Anthropic
client = Anthropic()
agent = client.beta.agents.create(
name="Security Reviewer",
model="claude-fable-5.1",
system=(
"You are a security-focused code reviewer. Flag injection risks, "
"hardcoded secrets, and unsafe deserialization. Be specific about "
"file and line numbers."
),
tools=[{"type": "agent_toolset_20260401"}],
)
environment = client.beta.environments.create(
name="review-env",
config={"type": "cloud", "networking": {"type": "unrestricted"}},
)
session = client.beta.sessions.create(
agent=agent.id,
environment_id=environment.id,
title="Auth module security review",
resources=[
{
"type": "github_repository",
"url": "https://github.com/your-org/your-repo",
"authorization_token": os.environ["GITHUB_TOKEN"],
"mount_path": "/workspace/repo",
"checkout": {"type": "branch", "name": "main"},
}
],
)
with client.beta.sessions.events.stream(session.id) as stream:
client.beta.sessions.events.send(
session.id,
events=[
{
"type": "user.define_outcome",
"description": "A written security review of /workspace/repo/auth covering "
"injection, secrets exposure, and deserialization risks.",
"max_iterations": 4,
}
],
)
for event in stream:
match event.type:
case "agent.message":
for block in event.content:
print(block.text, end="")
case "agent.tool_use":
print(f"\n[Using tool: {event.name}]")
case "session.status_idle":
print("\n\nReview complete.")
break
print(f"\nSession ID for later reference: {session.id}")This is close to what the official Chat SDK, assistant-ui, and CopilotKit reference quickstarts do server-side: one persistent session per task, a reducer that turns the event stream into UI state, and an outcome definition instead of an open-ended prompt so the agent knows when it's actually finished.
Troubleshooting: 8 common errors and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| 400 invalid_request_error on every call | Missing anthropic-beta header | Add managed-agents-2026-04-01 (or agent-memory-2026-07-22 for memory endpoints) |
| 401 authentication_error | Missing or expired API key | Regenerate the key in Settings > Keys and re-export ANTHROPIC_API_KEY |
| 403 permission_error on vault access | Session created without the vault attached | Pass vault_ids when creating the session, not after |
| 404 not_found_error on session | Session was archived or deleted | List sessions with GET /v1/sessions to confirm the ID is still active |
| 429 rate_limit_error on create calls | Exceeding the 300 RPM create-operation limit | Batch agent/session creation, or request a rate limit increase via the Rate Limits API |
| 429 on environment creation specifically | Environments are capped at 60 RPM and 5 concurrent | Reuse an existing environment across sessions instead of creating one per session |
| Stream silently drops early tool calls | User message sent before the stream connection opened | Always open events.stream() first, then call events.send() |
| Session runs far longer than expected and costs more | Agent stuck retrying a failing tool call with no outcome rubric | Attach a user.define_outcome event with max_iterations set, and set a deployment budget |
Managed Agents vs. building your own loop
Anthropic's own engineering writeup on scaling Managed Agents describes decoupling the "brain" (the model's reasoning) from the "hands" (tool execution) through an interface that lets the model interrogate context by selecting positional slices of the event stream, rather than replaying the entire history on every turn. That's a meaningfully different architecture from a naive while-loop that resends full conversation history to the Messages API on every call, and it's part of why context stays manageable across sessions that run for hours.
That said, independent developer reports describe real production failure modes: context compression during long sessions can drop safety-relevant instructions if they're not preserved carefully, and the default execution behavior is closer to "execute first, ask never" than a conservative human-in-the-loop pattern. Anthropic's own postmortem work on Claude Code, the sibling product built on the same agent loop, documents per-session usage throttles and permission rules that weren't always honored as expected, issues that were resolved in later releases but are worth testing for in your own deployment before trusting it with anything destructive.
The practical takeaway: use user.define_outcome rubrics and iteration caps for anything with a clear success condition, restrict environment networking unless a task genuinely needs unrestricted access, and treat the budget field on deployments as mandatory rather than optional for anything that runs unattended.
Frequently asked questions
Is Claude Managed Agents free to try?
New Claude Console accounts receive a small amount of free API credit that covers both token usage and session-runtime charges during testing. Beyond that, billing follows the standard per-model token rates plus $0.08 per session-hour of active runtime.
Does Managed Agents work with Claude Fable 5.1?
Yes. Fable 5.1, released September 1, 2026, is fully supported as an agent model, carries the 1 million-token context window, and gets the steepest prompt-caching discount of any current model at 0.025x base input price on cache hits.
How is this different from the Claude Agent SDK?
The Agent SDK is a library you run inside your own process on your own infrastructure, giving you the same agent loop that powers Claude Code but full control over orchestration. Managed Agents is a hosted REST API where Anthropic runs the sandbox, harness, and session storage for you.
Can I run Managed Agents on AWS or self-hosted infrastructure?
Managed Agents is also available on Claude Platform on AWS, with some differences in feature availability and session behavior, billed through AWS Marketplace using Claude Consumption Units. For sandboxed tool execution on infrastructure you control, set your environment's config.type to self_hosted instead of cloud.
Is Claude Managed Agents HIPAA compliant?
Not currently. Because sessions are stateful and store conversation history, sandbox state, and outputs server-side, Managed Agents is not eligible for Zero Data Retention or HIPAA Business Associate Agreement coverage as of this writing.
What's the rate limit for creating agents and sessions?
Create operations (new agents, environments, sessions) are capped at 300 requests per minute. Other operations, like reads and updates, are capped at 600 RPM. Environments specifically are further limited to 60 RPM and 5 concurrent environments. Those ceilings are far more generous than they used to be: Anthropic raised several API rate limits by nearly 17x in May 2026, according to the newsletter Every, so teams that hit limits earlier in the beta are worth re-testing against current caps before assuming they still apply.
Can an agent run on a schedule without a user triggering it?
Yes, through scheduled deployments. Create a deployment with a cron schedule field and Anthropic triggers new sessions automatically, with support for pausing, unpausing, and manually triggering a run outside the schedule.
What tools are available out of the box?
The agent_toolset_20260401 bundle includes bash command execution, file operations (read, write, edit, glob, grep), and web search and fetch, optionally restricted to a domain allowlist or blocklist. You can extend this with any MCP server your agent connects to.
