Why Does Anthropic Separate an AI Agent's Brain From Its Hands?

Katelyn Lesse says an agent's hands should only reach the network places the setup allows. Untrusted code can run in the sandbox, and egress can be an allow list or shut off entirely.

Claude Managed Agents ship that architecture out of the box. As the platform team learns a new control, customers get it without rebuilding the harness. She groups the new vocabulary as brain and hands, credentials, injection, and egress. Nine months earlier, nobody was using those words. They are new problems, and the team wants customers to pick up the fixes while Anthropic is still solving them in its own infrastructure. Internally, the same systems are being moved to secure by default.

She agrees that cloud brain with local hands, the projects work, is the shape of that split. Shawn Wang points out that Claude Code had been famous for a dangerously allow permissions mode on a person's own machine, and that this is the direction that mode is leaving.