Anthropic just sold the agent runtime, not the model

The listed feature set of Claude Managed Agents is a checklist of every problem early agent builders quietly suffer through. Sandboxed code execution. Checkpointing across long-horizon runs. Scoped credential management. Integration analytics. End-to-end tracing inside the Claude Console. Session billing measured to the millisecond, accruing only when status is "running." Anthropic's engineering blog frames this as "decoupling the brain from the body" — the model handles cognition, the platform handles persistence, isolation, and observability.

None of these features is novel in isolation. Every team running Claude in production has built versions of all of them. What Managed Agents sells is the combination, hardened, already integrated into the model's billing surface, and exposed through one declarative interface — either natural-language agent definition or a YAML file. Notion, Rakuten, and Sentry are the named launch partners; the implication is that for a buyer who would otherwise spend a quarter wiring up a homemade harness, the trade is obvious.

The runtime pricing is the tell. At $0.08 per active session-hour, Managed Agents is too cheap to be a profit center on its own. It is priced like infrastructure: low enough that the build-vs-buy decision tilts hard toward buy, low enough that the marginal cost of running an agent on Anthropic is not the runtime fee but the tokens. The runtime is a wedge, not a margin product. What it wedges into is the rest of the stack.

The model layer is, by every benchmark anyone trusts, increasingly commoditized. GPT-5, Claude Opus 4.6, Gemini 3, and a swarm of open-weight competitors trade leadership month-to-month on different evals. Switching costs at the model layer are low: change a string in the API call. Token pricing converges. The substitutability that should worry Anthropic, OpenAI, and Google is not coming from each other; it's coming from indifference — the realization in enterprise procurement that the model is interchangeable.

The harness is where switching gets expensive. Once an agent is checkpointed in a particular runtime, with a particular tracing and analytics surface, with credential scopes wired into the platform's permission model, with sub-agent orchestration patterns expressed in the platform's YAML, moving to a different vendor is no longer "change one string." It is a port. VentureBeat read this clearly, headlining Managed Agents as "a new one-stop shop" that "raises vendor lock-in risk." The lock-in framing is correct, but it's not malicious; it's structural. Lock-in is what happens when you concentrate enough of the production surface in one place that a switch becomes a migration.

This is the Aggregation Theory move, ported to AI infrastructure. Aggregators capture value not by having the best component product but by having the most integrated experience. Anthropic is wagering that an integrated agent-development experience — model + harness + console + billing — will beat a best-of-breed stack assembled from independent components, because integration reduces operational toil more than independent components reduce price.

The third-party harness ecosystem — Cursor, Cline, Continue, Aider, Devin, Replit Agent, Roo Code, dozens of internal tools — did the unpaid R&D for what Managed Agents now ships. Every pattern Anthropic productized in April 2026 was field-tested by builders who put Claude into a loop, got burned by lost state, and wrote checkpointers; who got burned by tool-call sprawl and wrote scoped credential brokers; who got burned by runaway sessions and wrote billing kill-switches. By the time Anthropic launched Managed Agents, it had three years of API telemetry telling it which patterns work and which fail.

The harness ecosystem also published its conventions. The Model Context Protocol, which now boasts more than 10,000 servers and 97 million monthly SDK downloads per Google's Cloud Next 2026 figures, is the most consequential of these. MCP normalized how an agent talks to a tool. Once that interface stabilized, the question of which runtime you used to host the agent stopped being a question of compatibility (anyone who speaks MCP can call any tool) and became a question of operational quality. Anthropic is competing, finally, on operational quality — which is exactly the dimension where it can lean on three years of running Claude Code internally.

The corollary is uncomfortable for the harness vendors. The features they built are now table stakes; Anthropic ships them as a free wedge under the model. Compete on integration depth — IDE-native flows, codebase indexing, design-doc workflows — or convert into Anthropic's customers and resell the runtime with vertical wrappers. Either path is viable; the middle, "general-purpose harness," is not.

A week after Managed Agents launched, Google Cloud Next 2026 reframed Vertex AI as the Gemini Enterprise Agent Platform and folded Agentspace into a unified offering. The structure mirrors Anthropic's on the surface — create, scale, govern, optimize — but the strategic claim underneath is wider. Google's argument, articulated by Thomas Kurian, is that it is the only company that owns all four layers of the agent stack: the silicon (Ironwood TPUs), the frontier models (Gemini), the platform (Vertex / Gemini Enterprise), and the distribution channel (Workspace, with three billion users across the productivity surface).

This is a different bet from Anthropic's. Anthropic is competing on agent-runtime quality assuming the model layer is interchangeable. Google is competing on vertical integration assuming runtime quality is interchangeable too — that whoever owns the complete stack from silicon to inbox wins by default, because every layer below the agent runtime contributes a structural cost or capability advantage. Project Mariner running 10 concurrent tasks in cloud VMs, agents that can run for up to seven days, Agent Gateway and Model Armor for governance: these aren't individual features so much as a claim that no one else can build the equivalent because no one else owns Workspace or designs their own TPUs.

OpenAI's position sits between the two. ChatGPT Workspace Agents and Codex have reached three million weekly users by extending the consumer surface into the enterprise — the bet that distribution-from-consumer beats distribution-from-cloud. The three approaches are not symmetric; they encode different theories of where the agentic stack's margin actually lives. Time will pick at most one.

The strongest argument against the lock-in framing is that the harness is no longer the boundary it once was. MCP exists precisely so an agent's tool surface is portable across runtimes. The 97-million-monthly-downloads figure for the SDK is not marketing fluff; it indicates that the protocol has crossed the adoption threshold where vendors who don't implement it pay a real ecosystem tax. As long as MCP holds, an agent built on Claude Managed Agents can, at least in principle, be lifted onto Gemini Enterprise or self-hosted on commodity infrastructure with a re-host, not a rewrite.

In practice, "in principle" does a lot of work. Tool schemas port; checkpointed conversational state, runtime-specific credential scopes, tracing pipelines, and cost dashboards do not. The portability argument tends to assume an agent is mostly its tool list, which is increasingly false as agents accumulate persistent memory (Anthropic's memory feature is in public beta under the managed-agents-2026-04-01 header), long-horizon plans, and runtime-coupled observability. The interface is portable. The substrate is not.

Which means MCP is doing exactly what protocols do at this stage of every platform cycle: it stops the lock-in from being total without preventing the runtime from becoming the product. Agents will be portable in the same way SaaS apps are portable: technically possible, operationally rare. That's a meaningful constraint on Anthropic's pricing power, but not a refutation of the strategy.

For a team starting an agent project in the next month, the practical implication of Managed Agents is not whether to use it — it's how to build so the choice stays reversible. Three rules fall out of the analysis above. First, treat MCP as the architectural commitment and the runtime as the deployment choice. Anything you write that bypasses MCP for runtime-native conveniences becomes a port cost when the runtime stops being the right answer. Second, store agent state in your own database, not the runtime's. Checkpointing is the convenience Managed Agents leans on hardest; it's also the feature that produces the deepest substrate lock-in. Treat the runtime's checkpoint as a cache, not a system of record. Third, instrument from your side. The Console's tracing is excellent; it's also a vendor surface. Mirror the spans into your own OpenTelemetry sink so you can see what the agent did even if you change runtimes.

The broader point is that the agent stack is no longer settling — it's actively re-stratifying. The model layer is commoditizing. The runtime is consolidating into a small set of vendor offerings (Anthropic, Google, OpenAI, plus the open-source self-host path on whichever orchestration framework wins). The protocol layer (MCP) is doing the load-bearing work of keeping any of this portable. Anthropic's Managed Agents announcement is the most concrete signal yet of where 2026's margin lives — not in weights, but in the production substrate that turns weights into agents that don't fall over.

The quote that sticks, from Anthropic's own engineering blog: "decoupling the brain from the body." That phrasing makes the body sound peripheral. Read it the other way: the body is what gets sold now.