A managed agent loop with your own infrastructure

Cloudflare and Anthropic have partnered on an integration that lets Claude Managed Agents run inside Cloudflare Sandboxes. The new setup, documented in the integration guide, hands developers control over agent sandboxes, secures connections to private services, and adds observability to agent runs.

The integration builds on Cloudflare's broader agent-focused platform work over the past year. That work includes Sandboxes for stateful Linux microVMs, the Agents SDK for building custom agent frameworks, Browser Run for programmable and observable browsers, and Dynamic Workers for sandboxed code execution at scale. The goal across all of these: make Cloudflare the default cloud for running agents.

With Claude Managed Agents, the agent loop itself runs on Anthropic's platform, but Cloudflare handles code execution, secure connections, and custom tool calls. Anthropic describes the split as "decoupling the brain from the hands." Developers who need control over infrastructure for security, compliance, or performance reasons can now keep the agent's reasoning on Anthropic while running its actions elsewhere.

A default deployment template gets a working environment up in minutes. The template includes:

  • Enhanced security — All agent traffic runs through customizable proxies, so credentials can be injected securely, data exfiltration can be blocked, and external interactions can be observed.
  • Sandbox control and observability — Detailed metrics and logs, SSH access to running machines, and customizable sandbox images.
  • Lightweight sandboxes — Untrusted code can run in either a microVM or a lightweight isolate for millisecond boot times and lower infrastructure cost.
  • Private service connectivity — Agents can reach internal services without exposing them to the public Internet.
  • Browser control and observability — Session recordings and human-in-the-loop flows provide an audit trail for browser activity.
  • Email — Each agent gets its own email address and sending capability.
  • Custom tools — Functions can be written and deployed without standing up additional infrastructure.

The onboarding flow starts with a repo fork and customization. Once set up, when a Claude Agent starts a session, it messages a Workers-based control plane. That control plane provisions a sandboxed environment for code execution, application development, and CLI work, with state persisted automatically across session sleeps. Sandbox instance sizes and container images can be configured as needed. Each sandbox is observable in the Cloudflare dashboard, and logs can be shipped to external providers like Datadog or Splunk. A built-in UI tracks sandbox state and provides interactive shell sessions.

Scaling with isolates instead of VMs

Full microVMs per agent get expensive as agent deployments grow. Cloudflare's answer is a sandbox based on the Agents SDK that runs code in Dynamic Workers via Codemode. This approach still provides a file system, but execution happens inside a V8 isolate rather than a microVM.

The tradeoff is straightforward. Agents that need to act like a developer — building full applications and running Linux-based tools — should use a microVM-based sandbox, available through Cloudflare Containers. But for workloads where speed and cost matter more, selecting "isolate" as the backend type gives a lightweight V8 isolate sandbox that can handle bursts of tens of thousands of concurrent agents in a way VM-based solutions cannot match.

Securing connections to private services

Agents become useful when they can reach organizational context, which usually means private services and data. Cloudflare's outbound proxy approach handles this with fully dynamic, zero-trust authentication between sandboxes and external services. Secrets are injected into requests outside the sandbox, so agents never have direct access to them — a protection against exfiltration.

For services that should never touch the open Internet, Cloudflare Mesh and Cloudflare Workers VPC provide post-quantum encrypted connections to cloud providers or on-premises infrastructure without a VPN or bastion host. Claude Managed Agents connect to these private services through customizable outbound proxies with header injection or private VPC/Mesh tunnels. Egress policies can expose only chosen endpoints to chosen agent sandboxes, allowlist specific hosts, inject encrypted credentials via zero-trust, and support custom proxy middleware. Policies apply per tenant, per agent, or based on any useful metadata.

Browser control, email, and custom tools

Several browser tools ship with the integration and can be enabled immediately: browser_search, browser_execute, screenshot, browse, fetch_to_markdown, and a Cloudflare-specific implementation of web_fetch. These run browsers on Cloudflare infrastructure, which makes auditing every browser action, applying allowlists and denylists, and recording sessions for debugging straightforward.

Email support comes built in with send_email, email_read, and email_list tools. Agents can use the Cloudflare Email Service to send from any configured domain, respond to forwarded context, and act autonomously over email. New sessions can even be kicked off via email.

Additional built-in tools include call_service, which connects to private services through Cloudflare Mesh or Workers VPC, and image_generate, which uses Workers AI for image generation alongside Claude's text-based inference.

For teams that need more, the repo is designed to be forked and extended. Adding a custom tool means adding a binding in the wrangler config, writing a zod definition, and implementing a short function in custom-tools.js. The surrounding platform offers more options: git-backed repos per agent session with Artifacts, edge inference with Workers AI, or hosting applications written on the fly with Dynamic Workers. Infrastructure and scaling are handled — the remaining work is writing a few lines of code and deploying.

Distributed execution for managed agents

Claude Managed Agents can now push their computational work beyond a single machine. Cloudflare's network becomes the execution layer, with each agent interaction capable of spawning hundreds or thousands of parallel subagents. This expands how many discrete actions an agent cluster can take simultaneously.

Each of those subagents can be isolated from the others for security. The Cloudflare Workers platform uses isolates — a lightweight sandboxing technology — to run agent processes. Since processes run in isolation rather than in shared containers, the resulting overhead per task is lower, and scheduling across the network is more granular. Each isolated interaction gets access to state, a sandboxed filesystem, runtime bindings, and network egress controls.

Running on a global network

Agent runs get distributed to Cloudflare's data centers in over 330 cities, rather than executing from a single origin region. For teams that need low latency for users spread out geographically, this can improve the responsiveness of agent-backed applications. Subagents execute near the user making the request, not centrally in one cloud region.

Because the platform is serverless, its scale is effectively elastic, handling small spikes or large bursts in agent traffic while maintaining low operational overhead for the team coordinating it.

Claude on Cloudflare ecosystem pieces

The integration includes:

  • Workers VPC — Private network connectors that let managed agents reach services inside a private network or VPC without exposing them to the public internet.
  • Zero-downtime deploys in Workers enable releases while a high volume of agent traffic is iterating on new versions.
  • Workers Builds, a native CI/CD system for deploying agents directly from a connected source repository, as well as a low-latency log pipeline.

For more details on how Managed Agents and Cloudflare work together, see the Getting Started with Managed Agents guide.