But the feature’s name can mislead security and compliance teams. Self-hosted execution is not self-hosted inference. According to Anthropic’s August 6 announcement, as reported by Unite.AI, the code checkout, files, build outputs, secrets provisioned to the runner, and changes made during a task can remain on customer-operated machines. Prompts, model responses, tool results, and session transcripts still travel to Anthropic for inference, and Anthropic retains the transcript so work can continue across the web, desktop, mobile, terminal, and scheduled-session interfaces.
That makes the new option a significant infrastructure change for enterprises, but not an on-premises Claude deployment. Teams with rules requiring that source code and build artifacts remain in a controlled network may now have a viable deployment route. Teams whose policy bars operational telemetry, tool output, prompts, or code-derived context from reaching a third-party model provider still have a material problem to solve.
The runner model moves execution, not the control plane
Unite.AI’s account describes a model familiar to DevOps teams: an organization creates named Claude Code environments and attaches a fleet of runners to each one. Those runners are long-lived processes installed on hosts controlled by the company, broadly analogous to self-hosted GitHub Actions runners or CI agents.
When a developer starts a Claude Code cloud session and selects one of these environments, Anthropic’s service queues the task. A runner polls outward to Anthropic, claims the work, clones the selected GitHub repository using credentials supplied by the organization, and starts Claude Code locally on that runner. The agent then reads files, runs builds, invokes tools, and writes changes in the customer’s environment.
Anthropic’s reported design choice is important for network teams: the connection is outbound HTTPS from the runner to Anthropic’s API, rather than an inbound connection from Anthropic into the enterprise network. That should fit environments that prohibit unsolicited inbound access and route approved traffic through egress gateways or corporate proxies.
It does not remove the need for a rigorous network policy. The runner is an automation host with access to repositories and, potentially, privileged internal services. If its outbound access is too broad, a compromised dependency, malicious repository instruction, or prompt-injection path could turn an autonomous coding session into a route toward systems that the hosted product could never reach. Anthropic’s own previous security work has emphasized that agentic coding tools need both filesystem and network boundaries because an agent capable of executing commands must be protected against malicious instructions embedded in codebases and other content.
The useful comparison is not a chatbot in a browser. It is a CI worker that accepts natural-language-directed work, can execute commands, and has a model provider in the loop.
Anthropic’s hosted cloud environment has a different security boundary
Anthropic’s existing Claude Code on the web documentation says its standard remote sessions run on Anthropic-managed cloud infrastructure. Those sessions use configurable cloud environments with setup scripts, network access levels, and outbound domain controls, but the underlying machine is still operated by Anthropic.
The self-hosted beta changes where commands execute. It is designed for teams whose normal build environment depends on internal certificate authorities, private artifact feeds, proprietary command-line tools, internal DNS, private source-control endpoints, or services that should not be reachable from a vendor-hosted sandbox.
That can eliminate awkward workarounds. A platform team no longer needs to publish a private registry through a public endpoint, place a broadly privileged VPN client in a third-party cloud environment, or reproduce every internal SDK and compiler in a remote image merely to let an agent compile and test a service. Prebuilding an approved runner image can also make Claude Code sessions more reproducible: every session can start with the same toolchain, package cache policy, internal CLI utilities, and observability agents.
The operational trade-off is equally clear. Anthropic is moving from operating the execution environment to coordinating work on machines the customer must patch, scale, monitor, isolate, and retire. Unite.AI reports that Anthropic supports both fixed runner fleets and on-demand runners controlled by an orchestrator, with one user assigned to each runner at a time. The latter is meant to prevent different users’ code checkouts from sharing a workspace, but it means organizations need to plan capacity around concurrent sessions rather than simply buying access to Claude Code.
For IT teams, this is a new service to own. There will need to be image hardening, vulnerability management, credential rotation, log handling, network segmentation, GitHub authentication controls, capacity controls, and an incident response path for agents that make unexpected changes. The cost is not a separate Anthropic compute charge, according to the report; it is the labor and infrastructure required to operate a safe runner platform.
“Code stays inside” has a narrower meaning than many buyers expect
The strongest selling point is also the point that needs the most careful reading. Anthropic’s reported data split keeps the repository checkout and artifacts on customer-operated infrastructure, but Claude still needs enough information to reason about the task. That information is supplied through the conversation and tool-result stream sent to Anthropic’s inference service.
In a real coding session, tool results can be highly revealing. A compiler error may contain internal paths, package names, source excerpts, hostnames, API responses, database schema details, usernames, stack traces, deployment configuration, and sometimes accidental secret exposure. A command such as
git diff,
grep,
cat, test output, or a failed deployment check can send code-derived material back through the session channel even if the original repository never leaves the runner as a checkout.
That is not a contradiction in Anthropic’s architecture. It is how a remote model can operate a local tool environment. It is, however, the line compliance teams must document precisely. The files may remain local while their contents, or information derived from them, can still enter the model conversation.
The zero-data-retention limitation underscores that boundary. Unite.AI reports that organizations using Anthropic’s zero-data-retention setting cannot use self-hosted environments. That is a decisive exclusion for organizations that treat transcript retention as the central compliance issue rather than storage location for repositories or artifacts. Anthropic appears to require retained session state to support the feature’s cross-device continuity, which lets a session begun on one surface be resumed elsewhere.
For those organizations, the question is not whether self-hosted environments are “private enough.” The question is whether the organization’s data-classification policy allows the specific prompts and tool outputs Claude Code will transmit to Anthropic, under the retention and processing terms attached to its enterprise account. A platform team should test that with deliberately representative, sanitized workloads before attaching a runner to a production network.
Remote Control and self-hosted environments solve different problems
Anthropic already offers Remote Control, which lets a user continue a Claude Code session running on their own machine from another interface. The new beta is not simply Remote Control expanded to an enterprise fleet.
A Remote Control session belongs to an individual machine and ends when that machine goes offline. The runner-based approach is shared infrastructure: an organization’s platform team operates capacity, and users select an approved environment rather than keeping their personal laptop awake. That makes it more appropriate for scheduled tasks, CI troubleshooting, automated pull-request work, and event-driven remediation.
InfoQ’s earlier reporting on Claude Code Routines described Anthropic’s push toward scheduled and event-triggered coding tasks running independently of an engineer’s active terminal session. Self-hosted environments give that direction a more credible path into tightly controlled enterprise networks. A scheduled task that can inspect a private CI failure, use internal build tooling, prepare a patch, and open a pull request becomes possible without first replicating the entire workflow in an Anthropic cloud sandbox.
The beta still has meaningful product boundaries. Unite.AI reports that only Claude Team and Enterprise organizations can enable it, that it is disabled by default, and that an organization must first enable Claude Code on the web. The reported repository path is GitHub, which means companies centered on GitLab, Bitbucket, Azure DevOps, or other source-control systems should not assume the runner will replace their existing workflow.
Anthropic also reportedly does not allow these sessions to route inference through Amazon Bedrock, Google Cloud’s agent platform, Microsoft Foundry, or a third-party LLM gateway. That matters to enterprises that have standardized model access, billing, audit, or regional controls through one of those platforms. They can self-host the execution host, but the model request remains tied to Anthropic’s own service.
Windows teams should avoid assuming native runner support
Claude Code itself supports Windows through WSL or Git for Windows, according to Anthropic’s setup documentation. That does not establish that this beta’s shared runner service is supported as a native Windows deployment.
The announcement details relayed by Unite.AI describe runner processes and container-style operational patterns, but do not identify supported runner operating systems, a Windows service model, supported orchestrators, container requirements, or whether Windows Server hosts are first-class targets. Those omissions are consequential for Windows-heavy enterprises that run build infrastructure on Windows Server, use Active Directory-integrated tooling, or depend on Windows-only compilers and signing systems.
Until Anthropic publishes the runner prerequisites and supported-host matrix, administrators should treat Linux-based runners as the safer assumption rather than promise a Windows-native deployment. A Windows organization can still benefit if its platform team can place Linux runners near the relevant internal services, but that is different from running the agent on the same Windows build hosts already used for Visual Studio, MSBuild, code signing, or desktop application packaging.
The public beta therefore gives enterprises a valuable new placement option, not an exemption from vendor dependency or security engineering. Organizations that need agents close to private tooling should evaluate it; organizations that need every byte of prompt and tool output to remain under their own control will find that Anthropic’s cloud inference and transcript model remains the limiting factor.
References
- Primary source: unite.ai
Published: August 7, 2026 at 4:34 AM UTC
Loading…
www.unite.ai - Related coverage: anthropic.com
Enabling Claude Code to work more autonomously \ Anthropic
Introducing Claude Code upgrades: native VS Code extension, terminal UX updates, and checkpoints for autonomous development. Handle complex tasks with confidence.www.anthropic.com - Related coverage: anthropic.com
Making Claude Code more secure and autonomous with sandboxing \ Anthropic
Learn how Claude Code's new sandboxing feature protects developers with filesystem and network isolation, reducing permission prompts and increasing user safety.www.anthropic.com - Related coverage: docs.anthropic.com
Advanced setup - Claude Code Docs
System requirements, platform-specific installation, version management, and uninstallation for Claude Code.docs.anthropic.com - Related coverage: resources.anthropic.com
Loading…
resources.anthropic.com - Related coverage: code.claude.com
Desktop application - Claude Code Docs
Get more out of Claude Code Desktop: parallel sessions with Git isolation, drag-and-drop pane layout, integrated terminal and file editor, side chats, computer use, Dispatch sessions from your phone, visual diff review, app previews, PR monitoring, connectors, and enterprise configuration.code.claude.com - Related coverage: code.claude.com
Loading…
code.claude.com - Related coverage: support.claude.com
Claude Code power user tips | Claude Help Center
support.claude.com
- Related coverage: claude-news.today
Loading…
claude-news.today - Related coverage: antkawam.github.io
Loading…
antkawam.github.io - Related coverage: claudecode.page
Loading…
www.claudecode.page - Related coverage: techtimes.com
Loading…
www.techtimes.com - Related coverage: infoq.com
Loading…
www.infoq.com - Related coverage: setup-code.com
Loading…
setup-code.com - Related coverage: cert.europa.eu
Loading…
cert.europa.eu - Related coverage: zhiqiangshen.com
Loading…
zhiqiangshen.com