Author(s): Gaurav Yadav

Originally published on Towards AI.

Anthropic shipped Managed Agents this week. AWS Bedrock AgentCore has been GA for five months. The interesting question isn’t who wins the runtime — it’s where the value migrates when the layer goes flat.

On April 8, Anthropic launched the public beta of Claude Managed Agents. The launch coverage hit the predictable beats: ten-times-faster shipping, Notion and Asana as adopters, sandboxed execution and checkpointed sessions and credentialed tool calls handled by Anthropic so developers don’t have to. The accompanying engineering post made a more interesting argument — that Anthropic had decoupled the agent stack into stable abstractions the way operating systems virtualized hardware in the 1990s. Session as durable event log living outside the model context. Harness as stateless executor that calls containers via execute(name, input) → string. Sandboxes as cattle, not pets, provisioned on demand. Reported wins: p50 time-to-first-token down roughly 60%, p95 better than 90%.

What Anthropic actually built

Strip away the launch language and Managed Agents is a reasonable, well-engineered hosted runtime. You define an agent — its system prompt, its tools, its guardrails — in YAML or natural language. Anthropic runs it. Sessions persist across days; tool calls happen inside isolated environments; credentials live in vaults the sandbox never sees; the trace of what the agent did is queryable after the fact. Pricing is consumption-based: $0.08 per session-hour of active runtime, on top of standard Claude token rates. Notion is using it to let teams delegate work to Claude inside their workspace. Rakuten built sales, marketing, and finance agents that route through Slack and Teams. Sentry pairs its debugging agent with a Claude agent that writes patches and opens pull requests.

The architectural piece is genuinely good, and the session-as-event-log pattern is the part worth isolating. State lives outside the harness. The harness can crash and resume from a wake(sessionId) call. The model context window stops being the load-bearing storage layer.

I’ll say something specific about why this matters. I ran an agent system last year where session state lived inside the context window. Forty minutes into a multi-step retrieval task, the context hit the window ceiling. The agent didn’t fail gracefully — it silently dropped the earliest tool results and started hallucinating against a partial history. We lost the session. We couldn’t replay it. There was no event log to inspect. The failure wasn’t dramatic; it was quiet and expensive. We rebuilt the state layer outside the context window the following week. Anthropic’s session-as-event-log is the same fix, productized. Anyone who has lost a long-running agent to context overflow knows immediately why this is the right pattern.

The credential isolation is the other detail that matters at production scale. Credentials bundled into the sandbox at provision time, never injected as environment variables the agent can read — that’s the kind of thing you only build after an LLM has already chosen the wrong curl command with a token it should never have seen.

The architecture is clean. It also shipped five months after the same primitive from Amazon.

The incumbent everyone forgot to mention

Amazon Bedrock AgentCore hit general availability in late 2025. By March 2026, AWS reported the AgentCore SDK had been downloaded over two million times in its first five months, with policy controls reaching GA in the same window. Each session runs in its own microVM with isolated CPU, memory, and filesystem. Sessions can run up to eight hours. The runtime is framework-agnostic — it will host LangGraph, CrewAI, Strands, or anything else that compiles down to a request-response loop, with the model choice left open to whichever Bedrock-hosted family the developer wants. Google Vertex AI Agent Builder ships its own version with an Agent Registry plumbed through Apigee. Microsoft folded AutoGen and Semantic Kernel into Azure AI Foundry to occupy the same slot.

Read against that backdrop, Anthropic’s launch is defensive, not pioneering. AgentCore can already host a Claude-powered agent. So can Vertex. If a developer’s primary loyalty is to Claude-the-model, the question Anthropic needed to answer wasn’t “should we build a managed runtime” — it was “if we don’t, how many of our token-buying customers will run their agents on someone else’s runtime, and how easily will they swap models when AWS undercuts us on session-hour pricing?”

That’s the actual launch logic. The coverage frames it as Anthropic claiming a new category. The competitive map says Anthropic is fortifying a developer base it cannot afford to lose to a hyperscaler that already owns the layer.

The obvious objection here is that Anthropic isn’t trying to win the runtime layer at all — they’re using managed agents as a distribution channel for Claude tokens, which is a fine and probably profitable thing to do. The objection is correct, and it doesn’t change the argument. Anthropic-the-company may be perfectly fine. Anthropic sells model inference, and model inference is a different layer with different economics. But the runtime layer they just entered is the layer being compressed, and a Claude-locked managed runtime is at best a distribution mechanism for tokens, not a defensible category in its own right. The piece of the stack that gets bid down toward zero is the piece they just shipped.

What the OS analog actually predicts

The engineering post leans on the operating-systems comparison deliberately. Sessions, harnesses, and sandboxes get separated into stable interfaces the way virtual memory and file descriptors abstracted hardware — the claim being that this lets each layer evolve independently and lets future Claude harnesses ship without rearchitecting the world below them. It’s a fair piece of pattern matching. It also has a known historical outcome that the post does not discuss.

VMware created the commercial x86 hypervisor in 1999. For about a decade, virtualization was a premium product — VMware sold ESX for tens of thousands of dollars per host and built one of the most valuable enterprise software businesses on the planet. Then the open source equivalents caught up. Xen shipped in 2003. KVM merged into the Linux kernel in 2007. By the early 2020s, surveys of enterprise infrastructure put open-source hypervisors at roughly 70% of new deployments. AWS, GCP, and Azure absorbed the layer entirely — virtualization stopped being a product category and became a substrate. VMware kept its installed base and a substantial revenue line, and it is still around, but the next decade of enterprise infrastructure value did not accrue to the people running hypervisors. It went up the stack: configuration management (Puppet, Chef), provisioning (Terraform), container orchestration (Kubernetes), and eventually the application platforms built on top of all of it.

Apply the same lens to the agent runtime layer. Anthropic is in roughly the position VMware occupied around 2005 — a high-quality proprietary runtime with real architectural advantages, shipping into a market that already has multiple competitors and a clear open-source pressure curve building beneath it. The hyperscalers (AgentCore, Vertex, Foundry) have absorbed the layer the way AWS absorbed hypervisors: not by building the best runtime, but by making it free-adjacent and bundled with cloud spend that is already on the customer’s procurement card. The open-source pressure is forming around projects like Daytona, which pivoted out of dev environments into AI agent infrastructure in early 2025, raised a $24M Series A in February, and quotes sub-90ms sandbox spin-up times. Kubernetes SIG shipped an official agent-sandbox project in the same window. ByteDance’s deer-flow crossed 59,000 GitHub stars as a long-horizon agent harness with planning and subagents built in.

The historical pattern, applied loosely, says: the runtime commoditizes within eighteen to twenty-four months. The companies that own the layer hold a real revenue line for years afterward. They are not the companies that capture the next decade of value.

Where the value goes when the layer goes flat

Each layer of the AI tooling stack has been compressing faster than the last. GitHub Copilot’s autocomplete in 2021 hollowed out paid Stack Overflow and the contractor market for routine coding work. ChatGPT in 2022 ate Chegg’s stock price and most of the homework-help SaaS economy in a single quarter. RAG pipelines in 2023 displaced the lower tier of document review, contract summary, and junior research workflows — not all at once, but fast enough that the headcount adjustments were visible by Q3. Tool use in 2024 chewed through large parts of the Zapier-and-RPA category. Coding agents in 2024–25 hollowed out the IDE plugin economy while building new categories on top of it — Cursor crossed $2B in annualized revenue by February 2026, and Anthropic has cited Claude Code generating something on the order of 4% of all public GitHub commits.

Each compression took roughly twelve to eighteen months from the first credible product to the moment the layer below became substrate. Managed agent runtimes are now the layer being compressed. The companies most exposed are the ones whose entire value proposition was running the harness or hosting the sandbox: pure-play sandbox vendors, agent framework startups whose business models depend on you not running LangGraph inside someone else’s microVM, and DIY harness consultancies. The companies positioned to benefit are the ones one floor up.

There are three places that floor is forming.

The first is the trace store. Three funded observability companies are racing to become the system of record for what agents actually did. Braintrust raised a $36M Series A at a $150M valuation behind Brainstore, an OLAP database engineered specifically for AI interaction logs. Arize has raised $131M total and ships Phoenix as Apache 2.0 to seed the open-source layer beneath its commercial product. LangSmith comes bundled with the LangChain ecosystem and inherits its install base by default. The competitive question isn’t which one has the best dashboard — it’s which one becomes the durable record that survives a runtime migration. Trace portability is not solved. Whoever solves it owns a layer the runtimes cannot easily reclaim.

The second is governance and policy. AWS shipped AgentCore policy controls to GA in March. The OWASP Agentic Top 10 published. Enterprise procurement is starting to ask the questions that follow predictably: what is this agent allowed to do, who approved that, what audit trail proves it. The defensive surface is wide and the tooling is thin. There is no incumbent yet. The category will exist within the year.

The third is vertical agent marketplaces. Salesforce reported Agentforce ARR reached $800 million by the end of Q4 FY2026, up 169% year-over-year, with 29,000 total deals closed — the canary that says enterprises will pay for the agent, not the runtime, when the agent does a job they recognize. The pattern from earlier waves repeats: once the substrate flattens, the money moves to whoever can walk into a procurement conversation with a vertical-shaped contract. Healthcare claims agents, sales-development agents, security-pentest agents, finance-research agents. The open source ecosystem is already producing the early versions — virattt/ai-hedge-fund and TradingAgents in finance, vxcontrol/pentagi in offensive security — and the capital is already chasing them.

A force function nobody is pricing in yet: self-improving agents are reproducible. The Darwin Gödel Machine paper out of Sakana AI’s group reported an agent that rewrote its own code to climb from 20% to 50% on SWE-bench, with the result independently verified by the SWE-bench team. The paper’s most recent revision is from March 12 of this year. When agents can rewrite themselves, sandboxing and observability stop being optional engineering hygiene and become the only thing standing between a useful tool and an unbounded process. The runtime layer becomes a regulatory question. The trace store becomes a legal artifact.

The question that actually matters

The question to ask about any agent-infra startup pitched in the next year is not whether their runtime is faster, cheaper, or more secure than the hyperscaler default. The hyperscaler default will be free-enough, fast-enough, and secure-enough by the end of the year. The question is what they own that survives the layer beneath them going to commodity. If the answer is “the runtime,” the historical analog is selling hypervisors in 2008 — VMware still had revenue, but the decade of value creation was already moving to the floors above. If the answer is the trace, the governance posture, the vertical contract, or the system of record — that is the layer where the next decade of value lives.

Anthropic’s launch is a reasonable defensive move. The architecture is sound. The pricing is competitive at small scale. None of that is the interesting story. The interesting story is that the layer is forming, the layer is commoditizing, and the smart bet for everyone watching is on the floor above it.

Numbers updated: Salesforce Agentforce ARR per Q4 FY2026 earnings (Feb 25, 2026). Cursor ARR per company disclosures and press reporting (Feb 2026). Claude Code GitHub commit share per Anthropic’s public claims — primary source pending independent verification.

Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.

Published via Towards AI