Anthropic shipped three updates to Claude Managed Agents this week that address real problems teams were already hitting in production environments. Unlike typical incremental platform tweaks, these changes directly solve gaps that forced teams to make uncomfortable trade-offs between compliance, security, and functionality.

What Changed in Claude Managed Agents This Week?

On August 19, 2026, Anthropic released three updates to its Claude Managed Agents platform, the infrastructure that powers multi-agent deployments at scale. The updates landed across three distinct areas: memory persistence, security controls, and session visibility.

These changes matter because they fix gaps that were forcing teams into difficult choices. For instance, organizations that needed to keep agent execution on their own infrastructure for compliance reasons had to give up persistent memory, the feature that lets agents learn from past interactions and carry user preferences across sessions. Now they don't have to make that choice anymore.

How Do Self-Hosted Sandboxes Get Memory Now?

When Anthropic launched self-hosted sandboxes in public beta on May 19, 2026, they offered a compelling trade-off: teams could keep tool execution, filesystem access, and network calls on their own infrastructure while Anthropic handled the model orchestration and API calls. The catch was that memory stores, the workspace-scoped documents that let agents retain user preferences and project conventions across sessions, only worked on Anthropic's cloud sandboxes.

The August 19 update changes this. Self-hosted sandboxes now support memory stores through a different mechanism than cloud sandboxes. Instead of a live mount, the SDK's EnvironmentWorker downloads each attached memory store to a local directory before the agent's tools run, then syncs changes back every 15 seconds by default. This interval is tunable down to a 5-second minimum.

The implementation comes with specific requirements and limitations worth understanding:

• SDK Support: Python, TypeScript, and Go SDK workers get full support through EnvironmentWorker, but the bare command-line interface worker does not support memory stores at all.
• Storage Limits: Self-hosted sessions can attach up to 8 memory stores per session, matching the limit on cloud sandboxes.
• Resource Types: Self-hosted sessions only accept memory store resources; file and GitHub repository resources are rejected with an error, so this doesn't turn a self-hosted sandbox into a general-purpose file-mounting mechanism.
• Infrastructure Requirements: The host needs a POSIX-compatible filesystem (Linux, not Windows), case-sensitive storage, and graceful shutdown with at least a 30-second stop timeout so in-flight memory syncs complete before teardown.

What this actually unlocks is significant: teams running agents against data that legally cannot leave their network can now give those agents the same learn-across-sessions behavior that cloud-sandbox agents have had. Before this update, self-hosting for compliance meant trading away memory. Now it doesn't.

Why Domain Controls on Web Tools Matter for Security

The second update is narrower in scope but arguably higher-stakes for security. The two built-in web tools in the agent toolset, web_search and web_fetch, now accept allowed_domains or blocked_domains restrictions. This prevents agents from searching or fetching content from domains you don't trust.

This addresses a real vulnerability. Web search results and fetched pages are exactly where prompt injection payloads arrive from the internet. A malicious search result or compromised webpage could inject instructions that override an agent's intended behavior. Domain controls add a guardrail against this attack surface.

The configuration is straightforward but has important nuances. A listed domain covers subdomains, so listing example.com covers docs.example.com. However, listing docs.example.com does not cover example.com or api.example.com. The bare domain covers both www and non-www versions. IP addresses, bare top-level domains, and internal-only suffixes like.local or localhost are rejected at validation time, so this is a domain-name mechanism, not an internal-network allowlist.

In multi-agent orchestrations, domain lists combine in a specific way. A sub-agent is bound by its own domain lists, the lists of whatever agent delegated to it, and the coordinator's current lists. Allowlists intersect, meaning a sub-agent can only reach domains permitted by all layers. Blocklists union, so a blocked domain stays blocked even if a sub-agent tries to widen access. A sub-agent can narrow what it can reach, never widen past what its coordinator already permits.

It's important to understand what this feature does and doesn't do. Domain controls govern only the web_search and web_fetch tools, which run on Anthropic's servers regardless of whether the session is on a cloud or self-hosted sandbox. If an agent has bash access and makes raw HTTP calls, or if it's on a self-hosted sandbox executing shell commands with network access, those paths are governed by the sandbox's own network policy, not by this feature. Treat domain controls as tool-level guardrails, not a substitute for actual network isolation.

How to Configure Domain Controls for Your Agents

Setting up domain restrictions involves adding configuration entries to your agent toolset. Here's how to implement these controls:

• Allowed Domains Configuration: Add an allowed_domains array to your web_search or web_fetch tool entry, listing only the domains your agent should access. For example, restricting to internal documentation and academic sources.
• Blocked Domains Configuration: Use blocked_domains instead if you prefer a blocklist approach, specifying domains your agent should never access. Never set both allowed_domains and blocked_domains on the same tool entry; the API rejects this with an error.
• Additional Web Fetch Controls: The web_fetch tool also gained max_content_tokens, capping how much of a fetched page's content enters the agent's context window. This prevents a research agent from blowing its context budget on one long page.
• Localized Search Results: The web_search tool gained user_location for localized results, matching the Messages API's existing user_location parameter, so agents can return region-specific information.

What About the Console Redesign?

The third update addresses a visibility problem in multi-agent sessions. The redesigned Console session viewer now provides visual tools to follow a multi-agent session's threads and see costs broken down per thread. The new interface includes a timeline minimap, transcripts grouped by model request, and an Inspector panel that makes it easier to debug complex agent orchestrations.

This matters because multi-agent sessions can become difficult to follow. When multiple agents are delegating to each other, making parallel requests, and sharing memory stores, understanding what happened and why becomes a detective job. The redesigned viewer makes that investigation faster and more intuitive.

Do You Need New API Keys or Authentication?

No. All three updates use the same authentication as any other Claude Managed Agents feature. You need an ANTHROPIC_API_KEY and the managed-agents-2026-04-01 beta header. Memory store endpoints use agent-memory-2026-07-22 instead, but the SDKs set this automatically. Nothing about these three updates changes how you authenticate.

It's also worth clarifying scope: these updates apply only to Claude Managed Agents. Claude Code, Anthropic's separate coding assistant product, has its own permission system and already had allowed_domains and blocked_domains support through the Messages API's web_search tools. This release doesn't change that path.

For teams running agent fleets in production, especially those managing compliance-sensitive workloads or dealing with untrusted content, these three updates remove friction that was forcing difficult trade-offs. Self-hosted deployments can now have persistent memory. Web tools can now be restricted to trusted domains. And multi-agent sessions are now easier to debug and cost-track. All three address real problems teams were already hitting.