Anthropic’s Managed-Agent Trap

Related: sources · notes · metadata · Drafts

The premise of Anthropic’s Managed Agents is obvious. It is also revealing.

The pitch is that the platform should let users get outcomes quickly with little work. Anthropic’s platform leads describe a future where the user supplies something closer to an outcome and a budget, while Claude figures out model choice, tool use, subagents, and orchestration. The managed platform absorbs the unpleasant infrastructure: servers, sandboxes, transcript storage, credentials, long-running sessions, and failure recovery. In their telling, users should not need to hand-build all of that just to get an agent into production.Source: Claude platform interview

That is a real market. It is also the contradiction.

If Claude automates engineering, why is building an agent platform difficult? The answer is that Claude automates local engineering motions. It does not abolish platform engineering. Code production is not durable agency under constraints. The hard parts are state, lifecycle, permissions, memory, observability, sandboxing, failover, security, credentials, human-in-the-loop routing, stale-agent retirement, and multi-user ownership. A model can write a function. A production agent platform has to preserve a world.

This distinction is already visible in the market. Codex winning some power users away from Claude Code shows that coding agents are products, not just models with terminals. Harness quality matters: diff surface, state handling, PR flow, sandbox lifecycle, repo hygiene, latency, cost, and whether the system leaves the codebase cleaner than it found it. Meanwhile OpenClaw and Hermes are far more ambitious runtime experiments: always-on agents, messaging ingress, shell access, browser control, memory, cron, skills, plugins, and cross-platform adapters. They are unstable and insecure by default, but they are exploring the actual surface area. Managed Agents is the enterprise-safe capture layer. It is not necessarily the future ontology.

The lock-in question is therefore not incidental. It is the product.

If memory, traces, sandboxes, credentials, skills, tool conventions, transcripts, and agent lifecycle live inside Anthropic’s platform, then customers are not merely buying inference. They are building inside Anthropic’s jurisdiction. Anthropic’s own platform argument points in this direction: model and harness are becoming increasingly paired, and the old generic harness with hot-swappable models may become less effective as each lab’s models diverge.Source: Claude platform interview

That is a lock-in thesis dressed as product wisdom.

There is a related budget trap. In Anthropic’s “thinking lever” framing, users can influence how Claude spends inference-time compute: tokens, time, and effort.Source: The thinking lever Product language makes that sound like control. Economically, it is ambiguous. Sellers love learning the buyer’s budget. Buyers usually do not want to disclose maximum willingness-to-pay before seeing a bid.

The buyer-side interface should not begin with “how much are you willing to spend?” It should begin with estimates: cheap pass, serious pass, exhaustive pass; expected confidence; stop-loss rules; marginal value; escalation only when verification warrants it. Once thinking is metered, an agent runtime is also a procurement system. Budget disclosure is not neutral UX.

For many companies, that is fine. Managed Agents is for product companies without strong infrastructure teams who want to ship agentic features fast, and for large non-technical organizations willing to pay for a supported path. Legal review, marketing approval, internal research, sales ops, support triage, compliance workflows, and team automation are natural use cases. These customers do not want to run their own sandboxes or model routers. They want a vendor to make the pain go away.

But serious AI-native companies are not the target. If agent orchestration is your core competency, you need to own the runtime. You need model routing, failover, evals, custom memory, sandboxes, artifact provenance, cost controls, permissions, verification, and the ability to compose Claude with models that Claude does not replace: high-throughput inference, video generation, video understanding, local/private models, search systems, specialized embeddings, and whatever comes next. If you outsource the agent substrate, you rent your nervous system.

This is why Dan Shipper’s interview posture was interesting. He was not weak; he asked real questions. But he asked them through the access-journalism register: praise first, deference first, then the hard question framed as his engineering team’s concern. That is less respectful than direct neutrality. “My team worries about lock-in” is a real question, but it puts corporate platform managers in an impossible position. They cannot say, “Yes, our managed platform will make you Anthropic-shaped.” They can only speak in generalities about convergence between first-party and external platform surfaces.

The sharper questions would be operational. Can I export transcripts, memory, traces, sandbox files, evals, and tool histories? Can I resume a run outside Anthropic? Can I bring my own sandbox? Can I route substeps to GPT, Gemini, DeepSeek, Kimi, Cerebras, or local models while preserving one provenance layer? Can I pin orchestration semantics? What is the feature lag between Claude Code and Managed Agents? What percentage of API customers does Anthropic expect to migrate to Managed Agents in the next three years?

Those questions expose the boundary without asking the guests to confess the business model.

The transcript also reveals a smaller cargo cult: files. Anthropic talks about file systems as if they are a Claude-specific primitive. They are not. Files are a general computer affordance. They worked beautifully for Claude Code because repos are already file-native: source files, tests, configs, logs, diffs, docs, CI outputs. But the lesson is not “Claude likes files.” The lesson is that files are useful when the state is textual, inspectable, local, and versioned.

Git is what makes files workable. It turns mutable workspace state into something closer to a persistent functional data structure: commits, trees, diffs, branches, rollback, merge. Without version control, file mutation by agents would be obviously insane. With Git, code becomes a tractable agent substrate. But Git is still only the 80% solution. It preserves content history, not semantic history. It knows which lines changed. It does not know whether an architectural invariant was violated, whether a fake test bypassed the real system, or whether a new API surface duplicated an existing concept.

The general principle is not “use files.” It is: use branchable, inspectable, reversible, provenance-bearing state. For code, that is Git over files. For documents, claims, memories, workflows, apps, and agent trajectories, the equivalent has to be built.

This is where Anthropic’s “harness withers away” instinct becomes dangerous. Their platform people gesture at a future where Claude gets so good that it understands itself, selects models, spins up subagents, and writes its own harness on the fly. That is the familiar bitter-lesson temptation: smart models, dumb data, less hand-designed scaffolding. But the real relation between model and harness is not substitution. It is compounding.

A better model makes better use of a better harness. A better harness gives the model better state, better tools, better observations, better memory, better action boundaries, cheaper verification, and lower entropy. The harness is where information is preserved across time. It externalizes memory, records provenance, constrains action, enables rollback, exposes failure, and makes long trajectories observable. There is no tradeoff between model intelligence and harness quality if both are engineered toward information-theoretic optima.

Anthropic wants to be Apple. That is the charitable version of the strategy: vertical integration, model plus runtime, managed primitives, safe defaults, coherent experience. But Apple earns its control through exceptional integration. Anthropic has Apple-quality hardware — the models — with software that does not yet match. The runtime taste is not there. The ontology is still chat, files, skills, sessions, sandboxes, and platform-managed agents. It is powerful, but it is not yet an operating system.

If Anthropic were genuinely great at harness engineering, Managed Agents would feel less offensive. It would feel like a superior vertically integrated machine. Instead, it feels like a monopoly move built around a still-immature runtime. And if Anthropic later makes the best models — say Mythos-class systems — exclusive to Managed Agents, the tactical logic is obvious. It would drive adoption and enforce safety narratives. But strategically it would teach serious builders the wrong lesson for Anthropic: do not trust the lab with your operational substrate.

The market will still exist. Managed Agents will help enterprises and product teams that want agent features without becoming agent-infrastructure companies. But the frontier is elsewhere.

The deeper product form is not “AI controls your device,” which fails because people have multiple devices, turn devices off, and experience agent control as invasive. It violates the tacit ownership contract. It is not “chat with many tools,” which fails because nobody wants to observe long-running work through a transcript, and because the single-primary-agent paradigm collapses under compaction, hidden tool calls, and integration instability. It is not VNC or remote desktop, which is terrible on mobile and mediocre on desktop.

The deductive endpoint is an automatic computer: persistent backend runtime, isolated execution, durable artifacts, portable UI, and agent-native app state. The user should not manage many agents. Every app may become an agent internally, but the user wants one coherent machine. Text or audio in; documents, code, images, video, apps, streams, or CAD artifacts out. Agents are not the interface. Artifacts are the interface.

That is the gap Choir aims at. Not an app builder. Not an agent builder. A media platform whose native object is the living artifact: vtexts, citations, claim graphs, appagents, revisions, and public memory. The “automatic newspaper” is the culturally legible surface. The dark software factory is the consequence. The same substrate that supports deep research and writing also supports coding, video production, streaming, live audio, CAD, and software generation, because all of them share the same information-theoretic skeleton: ingest, preserve provenance, transform artifact, verify, revise, publish, remember.

Anthropic Managed Agents is obvious. It may even be a good business. But it is not the final form. It is what happens when a model lab moves up the stack and tries to capture the operational layer before the industry has figured out what the computer is becoming.