AgentsAutonomy & tool use
Anthropic product and engineering heads describe Managed Agents' brain/hands split, anti-distillation API rules and Messages API rewrite in Rust
On Latent Space, Anthropic's heads of engineering and product describe running agent harnesses separately from the sandboxes that execute code, keeping credentials behind a proxy, enforcing append-only thinking to resist distillation, and porting the Messages API to Rust with Claude.
From the Latent Space podcast episode of October 27, 2026 and cited sources: Claude Managed Agents runs the harness, or 'brain', on a durable server. [2] [4]
SOURCES[2] Transcript: How Anthropic ships the #1 LLM in the World… rss.beehiiv.com[4] Anthropic Engineering: Scaling Managed Agents anthropic.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- Latent Space podcast episode, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- Studies
- arXiv 2608.20055 (Aug 2026) [5] date from arXiv ID
- When
- October 27, 2026 podcast episode published
- Covered
- Oct 28 edition
- Evidence
- 11 sources across 10 sites; transcript sourced
- 1How Anthropic ships the #1 LLM in the World safely…lspace.beehiiv.com
- 2Transcript: How Anthropic ships the #1 LLM in the World…rss.beehiiv.com
- 3Latent Space episode pagelatent.space
- 4Anthropic Engineering: Scaling Managed Agentsanthropic.com
- 5arXiv: EchoCoTarxiv.org
- 6Claude Docs: Preserved thinkingplatform.claude.com
Reach: not measured yet
Claude Managed Agents runs the harness, or 'brain', on a durable server. It starts sandboxes, the 'hands', only when code needs to execute, so a sandbox crash no longer ends the agent. The design was chosen for latency and reliability. Anthropic reports that median time-to-first-token fell about 60% and p95 fell more than 90%. Its main payoff turned out to be security: credentials sit in a separate vault, the agent sees only placeholders, and an egress proxy adds the real credential to outbound requests. Domain allow-lists can also limit network access. [2] [4]
To make chain-of-thought extraction harder, the API now requires thinking blocks to be preserved across turns. Each block is signed against the conversation history before it, so that history must be append-only. For accounts created from August 31, 2026, edited history returns an error. Anthropic added server-side compaction so harnesses that used to trim context by hand still work. The EchoCoT paper had shown that hidden reasoning can leak through replay between tool calls. [2] [5] [6]
The guests say most launch work now goes into safeguards, not features. A 'trust grant' authorization check on every request gates access to Mythos and to the cyber and life-sciences verification programs. Data-retention rules are set per model: Fable requires retention so coordinated multi-account abuse can be reviewed, while Opus 5.5 does not. [2]
With CPU now scarce and planned in advance, Anthropic moved its Python Messages API to Rust. The team had no Rust developers, so Claude wrote most of the code while engineers designed the system. Before rollout, the Rust version was checked by running live 'shadow' traffic through both versions and comparing outputs. [2]
Anthropic's engineering post and API docs describe both the architecture and the thinking rules. Implication: credential isolation and egress control can be built into infrastructure, not handled by prompt scrubbing.
Read the full assessment
Harnesses that edit or compact history will need to change.
Sources are verified; writing the dossier now.
Executive brief
Anthropic's agent runtime keeps credentials out of the agent's reach entirely. The agent only ever sees a placeholder, and a proxy adds the real credential to outbound traffic (transcript 01:05:37). On Latent Space, Head of Engineering Katelyn Lesse and Head of Product Angela Jiang (episode page) say this "brain vs. hands" split was built for latency and reliability, and that security turned out to be its biggest benefit. Other topics: anti-distillation changes to the API, permission checks that gate access to each model, and a Messages API rewritten in Rust, mostly by Claude. The episode was framed around Anthropic's October 26 S-1 filing.
What changed and event timeline
Brain/hands architecture published
Anthropic's engineering post on Managed Agents describes stateless harness "brains," sandbox "hands" and a durable session log. It reports p50 time-to-first-token down about 60% and p95 down over 90% ().
EchoCoT paper
Researchers showed that hidden chain-of-thought can be extracted through a "reasoning replay" surface between tool calls. They tested three open models and five proprietary ones ().
Preserved-thinking enforcement begins
For accounts created from this date, the API returns a 400 error when the conversation history before a thinking block has been edited. Older accounts must opt in ().
Claude Opus 5.5 ships
Priced at $4/$20 per million input/output tokens. Anthropic says it matches Fable 5.1 on most tasks and costs 40% less to run than Opus 5 ().
Distillation-defense results
Anthropic says reasoning tokens extracted by distillers on its platform fell 90–99% ().
S-1 filed, episode published
Anthropic filed to list on Nasdaq as "ANT" (). In the interview, Opus 5.5 "launched yesterday," which suggests a recording date around Sep 23 ().
Capabilities and access
- Claude Opus 5.5: 1M-token context, and thinking cannot be switched off (Crypto Briefing). Unlike Fable, it has no data-retention requirement (transcript 00:20:38).
- Preserved thinking: enforced on Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 (Docs).
- Gated access: Mythos access, cyber verification and a new life-sciences verification program run through "trust grants," permission checks applied on every request (transcript 00:21:31).
Read the full section
- Claude Opus 5.5: 1M-token context, and thinking cannot be switched off (Crypto Briefing). Unlike Fable, it has no data-retention requirement (transcript 00:20:38).
- Preserved thinking: enforced on Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 (Docs).
- Gated access: Mythos access, cyber verification and a new life-sciences verification program run through "trust grants," permission checks applied on every request (transcript 00:21:31).
- Effort default: Claude Code's default effort is now medium, and defaults differ by product tier (transcript 00:38:48).
Technical analysis for researchers and developers
- Brain/hands split: the harness runs on a durable server and starts sandboxes only when needed. A sandbox can crash without killing the agent.
- Preserved thinking: each thinking block carries a signature tied to the model, the organization and the history before it, so the history must be append-only.
- "Dreaming": one managed agent inspects another agent's work and writes memories back to it (transcript 00:46:25).
Read the full section
- Brain/hands split: the harness runs on a durable server and starts sandboxes only when needed. A sandbox can crash without killing the agent. Credentials sit in a separate vault, and an egress proxy injects them, alongside domain allow-lists (transcript 01:03:39–01:06:36; Anthropic).
- Preserved thinking: each thinking block carries a signature tied to the model, the organization and the history before it, so the history must be append-only. The
drop_blocksetting avoids errors but raises output tokens. Server-side compaction is the fix that still works (Docs). - "Dreaming": one managed agent inspects another agent's work and writes memories back to it (transcript 00:46:25).
- Rust port: the new Rust version was checked against the Python one by running live traffic through both and comparing outputs ("shadow traffic") (transcript 00:57:26).
Claims and evidence
- Rust port gains: 40–50% less CPU and 10–20% faster time-to-first-token. Both figures are vendor statements in the interview, with no published benchmark (Latent Space).
- Distillation defenses: the 90–99% reduction is measured only on Anthropic's own platform and has no third-party verification (Unite.AI).
- Revenue per employee: $6.6M, up from $1.4M a year earlier (Yahoo Finance live).
Read the full section
- Rust port gains: 40–50% less CPU and 10–20% faster time-to-first-token. Both figures are vendor statements in the interview, with no published benchmark (Latent Space).
- Distillation defenses: the 90–99% reduction is measured only on Anthropic's own platform and has no third-party verification (Unite.AI).
- Revenue per employee: $6.6M, up from $1.4M a year earlier (Yahoo Finance live).
- "First GAAP-profitable quarter": this was operating income ($974M in Q2 2026). The H1 net loss was $80.7B, largely from noncash convertible-debt charges (Yahoo; TechCrunch).
- Host's other claims: the "$2 trillion in two weeks" IPO and the compute-margin figures are not in the S-1 coverage reviewed. TechCrunch reports no valuation or timing has been disclosed.
Context and prior work
- The brain/hands design is a form of operating-system-style virtualization: stable interfaces that outlast a particular harness (Anthropic).
- Anthropic's first agents API was simply Claude Code inside a sandbox.
- EchoCoT extracted up to 66.4% of reasoning near-verbatim on open models. Against Gemini-2.5 it recovered 33,463 tokens from a 32,948-token target (arXiv).
Read the full section
- The brain/hands design is a form of operating-system-style virtualization: stable interfaces that outlast a particular harness (Anthropic).
- Anthropic's first agents API was simply Claude Code inside a sandbox. It was dropped because of boot latency and because a sandbox crash lost the whole agent (transcript 01:04:21).
- EchoCoT extracted up to 66.4% of reasoning near-verbatim on open models. Against Gemini-2.5 it recovered 33,463 tokens from a 32,948-token target (arXiv).
Limitations, safety and contested findings
- False-positive fallbacks: the safety classifier sometimes wrongly drops Fable sessions back to Opus, even partway through a response.
- Misclassification: Anthropic reports a misclassification rate under 0.1% and says users are charged for blocked requests (Unite.AI).
- Data retention: online classifiers cannot spot coordinated multi-account abuse, so Fable requires data retention to allow automated and human review (transcript 00:19:48).
Read the full section
- False-positive fallbacks: the safety classifier sometimes wrongly drops Fable sessions back to Opus, even partway through a response. Anthropic calls this frustrating and says it is still working on it (transcript 01:12:01–01:14:17).
- Misclassification: Anthropic reports a misclassification rate under 0.1% and says users are charged for blocked requests (Unite.AI).
- Data retention: online classifiers cannot spot coordinated multi-account abuse, so Fable requires data retention to allow automated and human review (transcript 00:19:48).
- Personalization evals: the guests admit Anthropic doesn't evaluate personalization (CLAUDE.md-style instructions) well (transcript 00:36:48).
Business and practitioner implications
- Harness builders: check how you compact context and whether you replay message history unchanged. New accounts fail hard on edited history (Docs).
- Agent platforms: keep credentials outside the sandbox and lock down outbound network access. This is an architectural defense, not prompt scrubbing.
- Infrastructure: CPU now needs advance capacity planning because sandboxes and CI runs compete for it (transcript 00:55:14).
Read the full section
- Harness builders: check how you compact context and whether you replay message history unchanged. New accounts fail hard on edited history (Docs).
- Agent platforms: keep credentials outside the sandbox and lock down outbound network access. This is an architectural defense, not prompt scrubbing.
- Infrastructure: CPU now needs advance capacity planning because sandboxes and CI runs compete for it (transcript 00:55:14).
- Cost-sensitive workloads: lower Opus 5.5 pricing makes it worth retrying long-running jobs that were previously too expensive (Yahoo).
The source trail.
Sources (11)
How Anthropic ships the #1 LLM in the World safely: Separating the Brain from the Hands
Transcript retrieved via published_transcript; language en. Timestamped text, not direct audiovisual review. Source: https://rss.beehiiv.com/podcasts/transcriptions/01a17e2f-ab7c-71cc-8281-518a0eb069f5.vtt. Automatic captions/transcription may contain errors.
lspace.beehiiv.comTranscript: How Anthropic ships the #1 LLM in the World safely: Separating the Brain from the Hands
published_transcript
rss.beehiiv.com