We've added two security improvements to Claude Managed Agents.

Self-hosted sandboxes keep the agent's execution environment in your infrastructure or with a managed sandbox provider.

MCP tunnels let the agent connect to services inside your security perimeter.