Anthropic lets teams run Claude Code on their own compute

Big company security teams usually break into a cold sweat the moment you mention letting a cloud AI agent run code against internal infrastructure.

Anthropic wants to take that anxiety off the table. The company just released self-hosted environments for Claude Code in public beta, rolling it out to organizations on Claude Team and Enterprise plans.

Instead of running execution sessions inside Anthropic-hosted sandboxes, companies can now deploy Claude Code runners directly on their own private clouds or on-prem servers.

Moving the runner behind your firewall

Under this setup, when a developer triggers Claude Code from the web, desktop, mobile app, or an automated routine, the session connects straight to an internal runner inside the company network.

This gives Claude immediate access to internal services, private package registries, and staging databases without requiring security teams to punch holes through the public internet.

Platform teams can also bake custom compilers, SDKs, and proprietary internal CLIs directly into the runner environment, meaning Claude starts up with every dependency already available.

Anthropic offers two runner architectures: a fixed mode where a set number of runners distribute incoming tasks, and an on-demand mode where an orchestrator boots and kills runners based on queue traffic. In both modes, each developer session operates inside an isolated workspace checkout.

This is distinctly different from Claude's existing Remote Control feature. Remote Control simply mirrors a session running on an individual engineer's laptop, dying the moment that machine sleeps. Self-hosted environments run on shared, managed enterprise infrastructure that anyone on the team can tap into.

What stays on-prem, and what still hits the cloud

Anthropic is drawing a very clear line around data handling.

Your source code repositories, compiled artifacts, secrets, and any files created or edited during the session remain entirely on your own compute infrastructure.

However, this is not a fully air-gapped solution. Conversation context, including user prompts, model responses, and tool outputs that might contain code snippets Claude inspects, still routes to Anthropic for inference. Session transcripts are also stored in the cloud so developers can resume sessions across devices.

The feature is turned off by default and is currently unavailable for accounts with Zero Data Retention agreements. Anthropic explicitly warned that companies will need dedicated developer experience or platform engineers to build runner container images and maintain the orchestrator.

Why it matters

We think this is a shrewd, calculated move targeting the real-world friction of enterprise AI adoption.

In our view, the biggest bottleneck for coding agents inside large organizations was never just model raw reasoning, it was network plumbing. An agent trapped in a generic public sandbox cannot hit private microservices or verify builds against internal dependencies, making it mostly useless for complex repos. Running the execution loop on-premises makes autonomous PR generation and CI bug fixing practical.

That said, teams should not mistake this for complete data isolation. Because tool outputs and code snippets read by the model still travel to Anthropic for inference, highly regulated teams bound by strict zero-exfiltration mandates still cannot touch it.

Anthropic is clearly challenging GitHub Copilot for high-paying enterprise contracts. By letting infrastructure teams control the runtime while keeping the underlying model hosted, Anthropic delivers the operational control enterprises demand without forcing them to self-host complex frontier weights.