Scaling Managed Agents: Decoupling the brain from the hands

생각 덩어리

하니스의 가정은 낡는다 — Opus 4.5에서 사라진 context anxiety

Harnesses encode assumptions that go stale as models improve.

in prior work we found that Claude Sonnet 4.5 would wrap up tasks prematurely as it sensed its context limit approaching—a behavior sometimes called “context anxiety.” We addressed this by adding context resets to the harness. But when we used the same harness on Claude Opus 4.5, we found that the behavior was gone. The resets had become dead weight.

'아직 쓰이지 않은 프로그램'을 위한 설계 — OS가 먼저 푼 문제

Building Managed Agents meant solving an old problem in computing: how to design a system for “programs as yet unthought of.”

Decades ago, operating systems solved this problem by virtualizing hardware into abstractions—process, file—general enough for programs that didn't exist yet. The abstractions outlasted the hardware.

The read() command is agnostic as to whether it’s accessing a disk pack from the 1970s or a modern SSD. The abstractions on top stayed stable while the implementations underneath changed freely.

에이전트의 가상화 — session·harness·sandbox 세 인터페이스

We virtualized the components of an agent: a session (the append-only log of everything that happened), a harness (the loop that calls Claude and routes Claude’s tool calls to the relevant infrastructure), and a sandbox (an execution environment where Claude can run code and edit files).

We're opinionated about the shape of these interfaces, not about what runs behind them.

펫을 입양하지 마라 — 단일 컨테이너의 대가

처음에는 모든 컴포넌트를 컨테이너 하나에 넣었다. 파일 수정이 직접 syscall이고 서비스 경계 설계가 필요 없다는 이점이 있었지만.

In the pets-vs-cattle analogy, a pet is a named, hand-tended individual you can’t afford to lose, while cattle are interchangeable. In our case, the server became that pet; if a container failed, the session was lost.

a bug in the harness, a packet drop in the event stream, or a container going offline all presented the same.

because that container often also held user data, that approach essentially meant we lacked the ability to debug.

An assumption baked into the harness became a problem when we wanted to connect it to different infrastructure.

뇌와 손의 분리 — 컨테이너도 하니스도 cattle

It called the container the way it called any other tool: execute(name, input) → string. The container became cattle. If the container died, the harness caught the failure as a tool-call error and passed it back to Claude.

Because the session log sits outside the harness, nothing in the harness needs to survive a crash. When one fails, a new one can be rebooted with wake(sessionId), use getSession(id) to get back the event log, and resume from the last event.

보안 경계 — 토큰은 샌드박스에서 닿을 수 없게

In the coupled design, any untrusted code that Claude generated was run in the same container as credentials—so a prompt injection only had to convince Claude to read its own environment.

Narrow scoping is an obvious mitigation, but this encodes an assumption about what Claude can't do with a limited token—and Claude is getting increasingly smart. The structural fix was to make sure the tokens are never reachable from the sandbox where Claude’s generated code runs.

Git push and pull work from inside the sandbox without the agent ever handling the token itself.

The harness is never made aware of any credentials.

세션은 Claude의 컨텍스트 윈도우가 아니다 — 비가역 압축 대신 durable log

Long-horizon tasks often exceed the length of Claude’s context window, and the standard ways to address this all involve irreversible decisions about what to keep.

But irreversible decisions to selectively retain or discard context can lead to failures. It is difficult to know which tokens the future turns will need.

In Managed Agents, the session provides this same benefit, serving as a context object that lives outside Claude’s context window. ... The interface, getEvents(), allows the brain to interrogate context by selecting positional slices of the event stream.

The interfaces push that context management into the harness, and only guarantee that the session is durable and available for interrogation.

많은 뇌, 많은 손 — TTFT p50 60%·p95 90% 하락

TTFT is the latency the user most acutely feels.

Every session, even ones that would never touch the sandbox, had to clone the repo, boot the process, fetch pending events from our servers.

Using this architecture, our p50 TTFT dropped roughly 60% and p95 dropped over 90%. Scaling to many brains just meant starting many stateless harnesses, and connecting them to hands only if needed.

In practice, this means Claude must reason about many execution environments and decide where to send work—a harder cognitive task than operating in a single shell.

The harness doesn’t know whether the sandbox is a container, a phone, or a Pokémon emulator. And because no hand is coupled to any brain, brains can pass hands to one another.

메타 하니스 — 인터페이스에만 opinionated

Managed Agents is a meta-harness in the same spirit, unopinionated about the specific harness that Claude will need in the future.

Meta-harness design means being opinionated about the interfaces around Claude: we expect that Claude will need the ability to manipulate state (the session) and perform computation (the sandbox).

But we make no assumptions about the number or location of brains or hands that Claude will need.