TL;DR: On May 19, 2026, Anthropic shipped two pieces of plumbing that change how enterprises can connect Claude to their internal systems. Self-hosted sandboxes move tool execution out of Anthropic’s infrastructure and onto the customer’s. MCP tunnels let agents reach private MCP servers through an outbound-only encrypted gateway, no inbound firewall rules required. The architectural choice that separates this from OpenAI’s April update: the agent loop stays on Anthropic, only tool execution moves out. The net effect is that credentials no longer have to ride along inside the agent’s context, a structural fix to a category of breach that has plagued every major MCP rollout in the last twelve months.

Anthropic’s MCP Tunnels Pull Credentials Out of Claude Agents

The enterprise AI agent conversation has had a circular quality since roughly mid-2025. Vendors promise that Claude or GPT or Gemini can finally do useful work inside the firewall, writing code against private repos, querying the internal data warehouse, filing tickets in Jira, drafting contracts in the document management system. Security teams respond with some version of “absolutely not.” Pilots stall. Production rollouts get postponed. The agents stay locked out of the systems where they would be most useful.

The reason isn’t model capability. It’s credentials.

In a typical Managed Agents deployment circa April 2026, the agent runtime carries authentication tokens with it as it executes tool calls. A long-lived OAuth bearer token to call the Salesforce API. A personal access token for GitHub. A service account key for the internal data warehouse. All sitting inside the agent’s context, where the language model can see them and where any prompt injection, sandbox escape, or supply-chain compromise can lift them.

The numbers say that’s not a hypothetical.

GitGuardian’s State of Secrets Sprawl 2026 counted 28.6 million new secrets exposed in public GitHub commits across 2025, with 24,008 unique credentials surfacing specifically inside MCP configuration files like claude_desktop_config.json and .cursor/settings.json. Google API keys made up roughly 20% of those MCP leaks, PostgreSQL connection strings another 14%. 2,117 were still valid at the time of disclosure.

The exposure isn’t only in configuration files. A joint Trend Micro and Bitsight scan catalogued 492 MCP servers reachable from the open internet with zero authentication and zero encryption. BlueRock analyzed more than 7,000 MCP server deployments and found 36.7% potentially vulnerable to server-side request forgery. OX Security disclosed a class of architectural vulnerabilities across the official MCP SDKs in Python, TypeScript, Java, and Rust. By their estimate, up to 200,000 vulnerable instances are exposed downstream.

And the incidents are no longer theoretical. CVE-2025-6514 lit up the mcp-remote OAuth proxy, downloaded more than 437,000 times from npm, turning every unpatched install into a vehicle for arbitrary command execution and credential theft. The first confirmed malicious MCP server in the wild, postmark-mcp, silently BCC’d every outgoing email to an attacker-controlled domain for weeks before anyone noticed.

The enterprise telemetry tells the same story. Gravitee’s State of AI Agent Security 2026 survey of more than 900 executives put confirmed or suspected agent security incidents at 88% over the previous twelve months, with only 21% of organizations claiming runtime visibility into what their agents do. Arkose Labs polled 300 security leaders and found 97% expect a material agent-driven incident within the next twelve months. Two-thirds of respondents in an Akeyless poll already suspect their agents have accessed data they weren’t supposed to touch. Average dwell time on a compromised agent in Akeyless’s data set is fourteen hours before detection, then close to a week to contain.

That’s the world into which Anthropic launched its May 19, 2026 update to Claude Managed Agents at Code with Claude London. Two features, both addressing the same underlying problem: how do you let an agent talk to internal systems without putting the keys to those systems inside the agent itself.

The credential-on-the-agent problem

The issue is structural. An autonomous agent that takes actions against internal systems needs to authenticate. Authentication requires credentials. If those credentials live in the agent’s runtime, its context, its environment variables, its mounted secrets, then anything that compromises the agent compromises the credentials.

And agents are compromisable in ways that traditional services are not. A regular API client doesn’t read tool descriptions and decide what to do next. An LLM does. A regular client doesn’t get nudged into exfiltration by a poisoned issue title or a booby-trapped knowledge-base entry. An LLM does. Add the fact that most agents in production are wired up with overprivileged, long-lived tokens because nobody wants to debug least-privilege scoping at 11pm on a Friday, and you get the wave of MCP-era breaches that researchers have been cataloguing since the spring of 2025.

The orthodox response has been to layer guardrails on top. Sanitize inputs, scrub tool outputs, restrict outbound egress, add a human-in-the-loop checkpoint. Useful, but it leaves the fundamental problem intact: the credentials are still in the agent.

Anthropic’s answer is to take them out.

What shipped on May 19

The Code with Claude London event was the venue. Two new capabilities, both on Claude Managed Agents:

Self-hosted sandboxes (public beta). Tool execution moves out of Anthropic’s runtime and into the customer’s. Three deployment options: run the sandbox directly on infrastructure you control, use one of the integrated managed providers (Cloudflare, Daytona, Modal, or Vercel), or build a custom sandbox client. The agent loop, including orchestration, context management, retry and error recovery, stays on Anthropic’s platform. The compute that runs tools, mounts files, and holds packages stays on yours.

MCP tunnels (research preview, access by request). A lightweight gateway deployed inside the customer’s network establishes a single outbound, end-to-end encrypted connection to Anthropic. Claude can then call Model Context Protocol servers behind that gateway, including internal databases, private APIs, knowledge bases, and ticketing systems, without any inbound firewall rules and without any public endpoints. The tunnel transport runs on Cloudflare’s network, but because the proxy terminates inner TLS using a certificate only the customer holds, Cloudflare itself can’t read request or response payloads.

Both are management-plane changes, not modelling changes. The Claude model is the same. What’s different is the wiring around it.

The split architecture

The interesting design decision is what Anthropic chose not to do.

The natural extension of “let customers run things themselves” would have been to let them run the whole stack themselves: agent loop, tool execution, the lot. That’s how some self-hosted LLM frameworks work. Anthropic chose otherwise. The agent loop stays on Anthropic’s infrastructure. Only tool execution and MCP connectivity move to the customer.

From VentureBeat’s reporting on the announcement: the architectural distinction Anthropic draws is a split between the agent loop on Anthropic’s infrastructure and tool execution on the enterprise’s own system. That separation is what existing sandbox approaches, including OpenAI’s, don’t make.

When OpenAI updated its Agents SDK in April 2026, it added what the company calls “harness-compute separation.” Developers can mount local files, point at storage providers like S3 and Azure Blob, and use built-in support for sandbox providers including Blaxel, Cloudflare, Daytona, E2B, Modal, Runloop, and Vercel. That gets you isolation of the execution layer, which improves security. But the harness, the part deciding what tool to call next, what context to keep, how to retry, can run wherever the developer puts it. In enterprise deployments that often means the harness runs on the customer side too, putting the customer back in the business of operating an agent runtime.

Anthropic’s bet is different. Most enterprises don’t want to operate an agent runtime. They want the orchestration loop to be somebody else’s problem. They want absolute control over where execution happens, what credentials are in scope, and what the network exposure looks like. The split architecture is built around that observation: outsource the loop, internalize the boundary.

Whether this is the right trade-off depends on how much you trust Anthropic to run the loop competently and how much provider lock-in you can tolerate. For organizations comfortable with the answer to both, the security model is tighter than what was available before. For those that wanted full provider neutrality, OpenAI’s SDK is the cleaner fit.

How MCP tunnels work

The mechanics are simpler than they sound, which is part of the point.

You deploy a small gateway process somewhere inside your network. It could be a sidecar in your existing Kubernetes cluster, a container on a bastion host, or a binary on a Linux VM. The gateway makes one outbound TLS connection to Anthropic’s tunnel endpoint. That’s the only network exposure. No public IP. No inbound port. No DNS record pointing at anything internal.

From Anthropic’s side, the gateway looks like any other tunnel endpoint. Tool calls from a Claude agent that need to reach an internal MCP server get routed through the existing outbound connection, sent encrypted with a certificate the customer issued, terminated inside the customer’s perimeter, and forwarded to whichever local MCP server holds the credentials for the target system.

The crucial property: the credentials never leave the perimeter. The agent doesn’t hold a database password. The agent doesn’t see an API key. The agent makes a tool call described in natural language, the call traverses the tunnel, and on the customer side a local MCP server with proper scoping translates that call into an authenticated request against the internal system.

If an attacker compromises the agent through prompt injection, tool poisoning, a supply-chain hit on a public MCP server, or any other vector, there’s no token to steal. The compromised agent can still attempt malicious actions, but those actions have to flow through MCP servers the customer controls, authenticate against credentials the customer scoped, and get audited by logging the customer owns.

That’s a different threat model, though far from perfect. An agent that gets compromised can still misuse the tools it’s been wired to. The blast radius is now bounded by what each individual MCP server allows, not by the union of every credential the agent happens to be carrying.

A caveat on the cryptography

The documentation describes the tunnel transport as encrypted and the trust boundary as clean, but the publicly available cryptographic detail at launch is thin. The overview confirms mTLS with customer-issued CA certificates and an additional Anthropic-managed encryption layer. The operational specifics, including supported cipher suites, key rotation cadence, and formal proofs of the integration with Anthropic’s existing connectors infrastructure, aren’t yet documented.

For organizations under heavy regulatory pressure in financial services, healthcare, and public sector, the right move is probably to read the security documentation directly, route the architecture through internal review, and treat the research-preview label as meaningful before standing anything up in production. InfoQ’s coverage and The New Stack’s both note the same gap in published detail.

That’s a reason to pilot, not a reason to dismiss. Every new piece of enterprise infrastructure goes through this phase.

A security architect’s evaluation framework

For teams trying to decide what to do with the May 19 launch, the useful questions break into four buckets.

1. Threat model fit

List the specific compromises you’re worried about. Then walk each one through the new architecture.

• Prompt injection causing token exfiltration. Before, the impact was high because tokens lived in the runtime. After tunnels, the impact is meaningfully reduced because the runtime no longer holds the tokens.
• Compromised MCP server in your agent’s tool list. Before, that server got to make authenticated calls. After tunnels, the same problem applies if the compromised server is one of yours, but the blast radius is tighter because the compromise is confined to whatever that one server can do.
• Sandbox escape from the tool runtime. Before, an attacker who escaped the sandbox was inside Anthropic’s infrastructure. After self-hosted sandboxes, an attacker who escapes is inside your infrastructure, where you presumably have detection and response. Better or worse depending on whose security posture you trust more, which is itself worth saying out loud.
• Supply-chain hit on a public MCP server you’re using. Before, same blast radius as token exfiltration above. After tunnels, better, with the same caveat about the individual compromised server.
• Insider with access to the agent runtime. Largely unchanged either way. The new boundary helps against external compromise, not against people you’ve already trusted.

2. Operational readiness

The architecture only works if you operate it. Audit logging on the gateway. Least-privilege scoping on each MCP server’s downstream credentials. Token rotation cadence. Anomaly detection on tunnel traffic. None of these come for free. The gain from moving credentials to the perimeter evaporates if the perimeter doesn’t have functioning monitoring around the credentials it’s now holding.

Teleport’s enforcement-gap data, surfaced through VentureBeat’s reporting, is the data point to keep in mind. Organizations that enforce least-privilege access for AI agents report a 17% incident rate. Organizations that don’t sit at 76%. That single control still does most of the security work, with or without tunnels.

3. Vendor risk and exit cost

The split architecture concentrates a real dependency on Anthropic. The orchestration loop runs on their infrastructure. Their availability is your availability. Their incident-response practices are your incident-response practices for the orchestration plane. If they have a bad day, your agents have a bad day, and there’s no way to fail over because the loop component isn’t something you can stand up yourself.

That’s the cost of operational simplicity. It should be priced in honestly, especially for workflows that touch availability-critical paths. For background agents doing batch work, the dependency is manageable. For agents in front of customer-facing latency-sensitive flows, it deserves more scrutiny.

4. Sequencing

Sandboxes are public beta. Tunnels are research preview. Those labels mean what they say.

The sensible sequencing for most enterprises is to start with sandboxes, which already move tool execution onto your infrastructure and meaningfully change the threat model. Tunnels can come next, piloted against non-production internal MCP servers, with the explicit understanding that the contract between Anthropic and the gateway component is still evolving. Teams that commit to tunnels in production right now are betting on Anthropic stabilizing the surface area on a particular timeline. Reasonable, but a bet.

Why this lands now

The timing isn’t coincidence.

Anthropic spent the back half of 2025 and the front half of 2026 absorbing a series of bruising public security incidents. Two high-severity CVEs in its own Filesystem MCP server (CVE-2025-53109 and CVE-2025-53110, CVSS 8.4 and 7.3), disclosed in July 2025. The Claude Code source-map leak on March 31, 2026 that exposed 512,000 lines of agent code and gave attackers a free tour of how the company’s flagship coding agent works. A community of pen testers and red teamers that has gotten good at finding ways to make agents behave badly with valid credentials in hand.

Meanwhile, the enterprise demand signal has gotten impossible to ignore. McKinsey, Gartner, and roughly every analyst firm publishing in 2026 is calling agentic AI the dominant infrastructure trend of the year. Akeyless found that two-thirds of enterprises already suspect AI agents have accessed data they weren’t supposed to touch. Almost four in five organizations have deployed agents in some form, but only one in nine has agents running in production. The gap is governance and security, not capability.

Anthropic, like every model provider, needs that gap to close. Without enterprise production deployments, the revenue model thins out fast. The May 19 update is a credibility play. Here is the architecture, here is the boundary, here is the bit you control.

It also lands at a moment when the Cloud Security Alliance’s Agentic Trust Framework and similar emerging standards are pushing hard on the idea that traditional zero-trust models don’t translate cleanly to autonomous agents. You can’t just authenticate the caller when the caller is an LLM dynamically assembling context from untrusted sources. The control point has to move somewhere else. Anthropic has now picked a where: the network boundary, owned by the customer, holding credentials the agent never sees.

What changes for orchestration teams

If you’re running Claude Managed Agents today, the practical path forward isn’t complicated, but it does require thinking about two layers separately.

Sandboxes determine where things run. Tool execution location, compute resources available to the agent, network egress controls, audit logging are all configured at the sandbox layer. If you’ve been waiting to move tool execution onto your own infrastructure, public beta is your moment. Standard procedure: stand up a self-hosted sandbox in a non-production environment, point a single low-risk agent at it, run your usual workloads, watch the egress logs, watch the resource utilization, watch what your security tooling now sees that it didn’t before. The compute is yours; the visibility should match.

MCP tunnels determine how agents reach private systems. Tunnels are a separate concern, layered on top. They tell the agent how to find an internal MCP server, not where to execute. That separation is deliberate, and it’s what lets enterprises map agent workflows more granularly. The agent loop on Anthropic. The execution sandbox on you. The MCP servers behind the tunnel, also on you. Three layers, three boundaries.

The recommendation that keeps surfacing in coverage of the update is to start with sandboxes before touching tunnels. Tunnels are still in research preview. Sandboxes are in public beta. The threat model improvement from sandboxes alone is the bigger immediate win. Tunnels are the multiplier once you’re ready.

For teams evaluating Claude Managed Agents from the outside, comparing against OpenAI’s Agents SDK, against agent frameworks like LangGraph or AutoGen, or against rolling your own, the sandbox architecture is what to weigh. Pricing matters. Model quality matters. But the piece that changes whether you can ship agents into production is whether the platform’s boundary lines up with your boundary. Anthropic’s now does, in a more specific way than it did a month ago.

What’s still missing

A few things to acknowledge before signing off.

The split architecture means Anthropic still operates the loop. If your compliance posture requires that nothing about your agent workflow runs outside your control, sandboxes and tunnels don’t get you all the way there. You still have to trust the orchestration plane, the context management, and the parts of the system Anthropic considers proprietary. For most enterprises this is acceptable. For a meaningful minority, it isn’t, and they will probably keep looking at fully self-hostable open-source frameworks.

MCP tunnels are research preview, and that label carries weight. Expect rough edges, expect documentation gaps, expect the contract between Anthropic and the gateway component to evolve.

The credentials problem isn’t fully solved either. Moving credentials out of the agent context is enormous. But MCP servers themselves still hold credentials. They have to, in order to authenticate against the systems they front. So the problem moved from “credentials inside an LLM-driven runtime” to “credentials inside a properly engineered service inside your perimeter.” That’s a much better place for them. It’s not no-credentials anywhere.

There are also existing categories of agent risk this update doesn’t touch. A correctly authenticated agent that gets prompt-injected can still misuse the tools it has. Audit logging is now owned by you, which is better than not having it, but you still have to look at the logs and respond to anomalies. Least-privilege scoping of MCP server permissions is the boring, manual, project-by-project work that determines whether a compromised tool produces a small mess or a large one. There’s no architecture trick for that part.

Anthropic gave you better plumbing. The discipline of using it well is still on the customer.

The bigger pattern

The May 19 update fits into a pattern that’s been visible for months. Every model provider serious about enterprise revenue is racing to redraw the line between what they operate and what the customer operates. OpenAI did it with the Agents SDK harness-compute split in April. Google has been moving the same direction with managed MCP. AWS Bedrock has been carving up the same trade space from the other end, starting with customer-owned infrastructure and adding orchestration on top.

A shared-responsibility model for agents is emerging, analogous to the one cloud providers and customers settled on for IaaS a decade ago. The model provider runs the inference and, depending on the vendor, the orchestration. The customer runs the perimeter, the credentials, the tool implementations, the audit. The interface between the two is where the security work concentrates.

Anthropic’s choice to split the loop from the execution puts its line in a specific place. Whether that line holds, whether the customer-owned components do what they’re advertised to do, whether the tunnel cryptography is as tight as it sounds, whether the operational story works in practice, is the question the next twelve months will answer.

For now, the directional move is real. If you’ve been waiting for the moment when Claude could finally talk to your internal systems without making your security team revolt, that moment got closer this week. The credentials don’t have to live in the agent anymore. The blast radius is bounded. The boundary is in a place you can defend.

That isn’t every problem solved. It’s a fix to the specific structural one that has been blocking serious agent deployments for the last year. For the orchestration teams who have been holding the line, that’s enough to change the calendar.

Related reading on this site:

• MCP Is the Backdoor Your Zero-Trust Architecture Missed
• Google’s Managed MCP Servers for AI Agents
• Anthropic Wants to Own Your Agents’ Memory, Evals, and Orchestration

Sources:

• Anthropic, New in Claude Managed Agents: self-hosted sandboxes and MCP tunnels
• Anthropic, MCP tunnels overview
• Anthropic, Code with Claude London
• VentureBeat, Claude agents can finally connect to enterprise APIs without leaking credentials
• The New Stack, Anthropic debuts MCP tunnels and self-hosted sandboxes
• InfoQ, Anthropic Introduces MCP Tunnels for Private Agent Access
• 9to5Mac, Anthropic enhances Claude Managed Agents with two new privacy and security features
• TechCrunch, OpenAI updates Agents SDK to help enterprises build safer agents
• Help Net Security on GitGuardian’s State of Secrets Sprawl 2026, 29 million leaked secrets in 2025
• Trend Micro, MCP Security: Network-Exposed Servers Are Backdoors to Your Private Data
• BlueRock, Private Repo Scanning for MCP Servers
• OX Security, The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of MCP
• JFrog, CVE-2025-6514: Critical RCE Vulnerability in mcp-remote
• Snyk, Malicious MCP Server on npm postmark-mcp Harvests Emails
• Cymulate, EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server (CVE-2025-53109 & CVE-2025-53110)
• InfoQ, Anthropic Accidentally Exposes Claude Code Source via npm Source Map File
• VentureBeat on Gravitee’s State of AI Agent Security 2026, the enforcement gap
• Arkose Labs, 97% of Enterprises Expect a Major AI Agent Security Incident Within the Year
• Akeyless via PR Newswire, Two-Thirds of Enterprises Suspect AI Agents Have Already Accessed Unauthorized Data
• Cloud Security Alliance, The Agentic Trust Framework: Zero-Trust Governance for AI Agents