Agents as a Provisioned Compute Primitive

Google and Anthropic shipped managed agent compute in the same week - agents are a cloud primitive now.

Evyatar Bluzer
3 min read

An agent used to be something you prompt. As of May 19 it is something you provision - Google and Anthropic both shipped managed agent compute that day, and neither launch reads like an experiment.

What Shipped

On May 19, Google launched Managed Agents in the Gemini API. A single API call spins up an agent with its own isolated Linux sandbox, reasoning loop, tool access, web search, and file system; the agent executes, returns results, and the sandbox tears down, with no orchestration code and no infra management on your side.

The same day, Anthropic shipped self-hosted sandboxes and MCP tunnels for Claude Managed Agents. Self-hosted sandboxes let the agent loop run on Anthropic's infrastructure while tool execution happens on yours - Cloudflare, Modal, Vercel, or bare metal. MCP tunnels let managed agents reach private MCP servers without exposing them to the public internet: one outbound connection, no firewall rules, end-to-end encryption.

Two companies landed on the same conclusion in the same week. Managed models were never the end state; agents need managed compute.

The Architecture That Matters

Google's approach is fully managed. The Antigravity harness powers every surface - desktop app, CLI, SDK, IDE - and now powers the API too. Each managed agent gets a sandbox with no network access by default; you send a task, the agent reasons and acts, and the compute boundary is Google's problem.

Anthropic splits the plane instead. Orchestration stays managed while execution goes wherever your data lives, so the agent reasons in Anthropic's cloud but runs tools inside your security perimeter. That hybrid - managed intelligence, self-hosted execution - is the shape enterprises have been asking for.

Compute boundaryA highlighted vertical line splits the picture into vendor cloud on the left and your perimeter on the right; the top row has one box on the left only, the bottom row has a box on each side joined by an arrow and a second right-hand box with an arrow back across the line. VENDOR'S CLOUD YOUR SECURITY PERIMETER compute boundary Google, Managed Agents in the Gemini API Reasoning loop + Linux sandbox tools, web search, file system no network by default; torn down after nothing to host; the compute boundary is Google's problem Anthropic, Claude Managed Agents Agent loop, orchestration reasons in Anthropic's cloud Self-hosted sandbox tool execution on Cloudflare, Modal, Vercel or bare metal runs tools Private MCP servers never exposed to the public internet MCP tunnel: one outbound connection, no firewall rules, end-to-end encrypted
Where the compute boundary falls: Google keeps the reasoning loop and the sandbox on its side, Anthropic keeps only the agent loop and lets tool execution and private MCP servers stay inside your perimeter, reached through an outbound MCP tunnel.

Underneath, both are the same pattern: agents as a provisioned compute primitive. Like containers, except the unit of deployment is a reasoning loop instead of a process.

What Does This Take Off My Plate?

Quite a lot. I have been building agent systems where I manage the sandbox, the tool registry, the error recovery, and the execution lifecycle myself - the scaffolds and throttles of the harness - and that entire layer just became someone else's problem. The trajectory looks like containers all over again: first you ran processes on VMs you managed, then Docker abstracted the runtime, then Kubernetes abstracted the orchestration, then the managed cloud ate all of it. Agents are walking the same path, compressed into months instead of years.

The unit of work used to be a model call. Now it is a provisioned agent - scoped, torn down when done, and operating inside a budget envelope.

Where This Heads

Agent provisioning will become as routine as container orchestration, resource limits and isolation policies and lifecycle management included. Some teams will treat agents that way and ship reliably; the rest will keep writing prompt chains. I maintained that layer by hand long enough to know which group I am joining.

Comments