Building an AI agent is relatively easy. Keeping it running in production without it hallucinating, crashing, or leaking credentials is a completely different story. When Anthropic rolled out Claude Managed Agents earlier this year, the pitch was simple: let them handle the messy infrastructure layer—the secure sandboxing, long-running sessions, and tool execution—so developers could focus on what the agent actually does. It was a massive step toward making autonomous workflows viable at enterprise scale, addressing the runtime and orchestration challenges. But as anyone who builds on top of emerging platforms knows, the real test isn’t the initial launch; it’s the iterative updates that follow based on real-world friction. In a recent update, Anthropic pushed out a new batch of features for Managed Agents, and while they might sound like minor plumbing adjustments, they collectively solve some of the biggest headaches developers have been facing over the last few months.

Related /

• Anthropic adds long-term memory to Claude Managed Agents
• Claude agents can now “dream” their way to better performance
• Anthropic just made AI agents boring—in the best way

At the top of the list is the introduction of streaming session event deltas. If you’ve been building user-facing applications with AI, you know that waiting for a long-running agent to finish a complex task in silence is a surefire way to frustrate a user. By streaming the event deltas as they happen, developers can now build much more responsive interfaces, surfacing exactly what the agent is thinking, doing, or executing in real-time.

But perhaps the most universally requested feature in this update is per-session agent overrides. Until now, the API required a fairly rigid setup: you define your agent—its model, system prompt, tools, and MCP servers—and that configuration is locked in as a versioned release. If you wanted to test how a different model handled a specific task, you generally had to create an entirely new agent configuration. With per-session overrides, you can take a stored agent and swap out parts of its DNA just for one specific session. Want to temporarily switch to a heavier model for a harder query, or inject a specialized tool for a single run? You can now do that on the fly without cluttering your workspace with duplicate agent profiles.

The update also brings some much-needed quality-of-life improvements for backend orchestration. Anthropic has added new webhook event types, giving developers more granular hooks into the agent’s lifecycle to trigger downstream actions in their own applications.

They’ve also introduced reverse pagination, which sounds mundane until you’re staring at a massive, long-running session log and just want to see the most recent events without fetching the entire history first.

And for developers obsessed with performance metrics, Anthropic quietly dropped a brand new Managed Agents Observability tab into the developer console. Instead of guessing how much compute an agentic loop is burning through, you can now see session-level metrics, tracking exactly how many input and output tokens were consumed and how frequently specific tools were called.

The most critical update in this release, however, is arguably the quietest: credential injection scoping. Security has always been the elephant in the room for autonomous agents. If an agent has access to a sandbox and external tools, a clever prompt injection could theoretically trick it into reading its own environment variables or exfiltrating tokens. While Anthropic’s security architecture already separates the “brain” (the model) from the “hands” (the execution sandbox), credential injection scoping tightens the blast radius even further. It allows developers to define exactly which credentials get injected into which specific tool executions, ensuring that an agent only has access to a particular secret at the exact moment it needs it, rather than leaving the keys to the kingdom broadly accessible in the runtime environment.

Taken together, these five updates—streaming deltas, overrides, webhooks, reverse pagination, and scoped credentials—show a platform that is maturing rapidly. We are moving past the era of weekend hackathon projects and into a phase where enterprise-grade AI requires the same robust tooling, observability, and security controls as any other piece of critical cloud infrastructure. Anthropic clearly understands that to win the agent race, they don’t just need the smartest model; they need the most reliable runtime. And with this latest release, the gap between a cool prototype and a production-ready agent just got a little bit smaller.