Anthropic separates the model from the agent to run Claude in production without breaking

In the October 27, 2026 episode of the Latent Space podcast, engineers Katelyn Lesse and Angela Jiang, both from Anthropic, spent more than 100 minutes detailing the engineering behind the Claude Platform. The conversation isn't about the Opus 5.5 launch itself, but about the infrastructure that allows this model (and the agents built on top of it) to run in production without an autonomous agent taking an irreversible action on its own.

The throughline of the interview, according to the episode notes, is a conceptual separation that Anthropic calls "brain" and "hands": the model (the brain) decides what to do, but doesn't execute anything directly. What executes is a harness, a sandbox, and a set of network and credential controls, the hands. For anyone building agents today with loose function calling or unisolated MCP, this distinction is the kind of lesson that only shows up after something breaks in production.

Why separate the brain from the hands

The logic is simple to state and hard to implement: if the model is just a function that receives context and returns a decision, it can be updated, tested, and even swapped out without rewriting the layer that actually touches files, calls external APIs, or moves money. The harness, in turn, is treated as a separate piece of infrastructure, with its own lifecycle.

The episode notes link to Anthropic's own "Scaling Managed Agents" post, described as the material that decouples "the brain, the harness, and the sandbox." This matches a pattern that already appears in open source agent frameworks: separating the reasoning loop from the tools layer isn't exclusive to Anthropic, but the company is formalizing it as product architecture, not just as a coding best practice.

In short: the model never has direct access to credentials, network, or file system. Every action passes through an intermediate layer that can log, limit, and, above all, revoke.

How Anthropic contains Claude

Another piece cited in the episode notes, "How Anthropic contains Claude," describes the isolation mechanisms: execution sandboxing, credential protection, and network controls. Based on the conversation's timestamps (1:05:25 "Protecting credentials and sandboxes"), this is one of the most technical blocks of the interview.

In practice, this means an agent with access to an API token doesn't store that token somewhere the model itself could read and leak in an output. The physical separation between what the model "knows" (the context it receives) and what it "can do" (the credentials the harness holds and uses on its behalf) is what keeps a prompt injection from turning into a security incident with real cost.

For anyone who has already tried giving an agent access to a Postgres database via MCP, this is exactly the friction point that usually gets resolved badly: either the agent has a direct read/write credential (high risk), or every action goes through a function called by the host, never by the model (safer, slower to prototype). With this brain/hands separation, Anthropic is saying it structurally chose the second option at platform scale.

Agents that survive the context window

The third link in the episode notes, "Effective harnesses for long-running agents," addresses a problem every dev who has built a long-running agent knows: how to keep progress when the model's context is finite and the task isn't. The conversation's timestamps (44:25 "Memory, dreaming, and agent harnesses" and 48:25 "Evaluating agents") suggest Anthropic treats this as a harness problem, not a bigger-model problem.

The idea, as the block titles suggest, is that the harness persists state outside the context window, an external record of progress, and re-injects into the model only what's relevant to the next decision. It's a division of responsibility similar to that of a classic workflow orchestrator (like Temporal) paired with an LLM in place of business logic: the state lives outside, and the model decides step by step.

The episode doesn't provide success-rate numbers for these long-running agents, nor a benchmark comparing different harnesses. This matters for anyone evaluating the solution: the content describes architecture, not a publicly measured result.

The engineering behind the scale: Rust in the Messages API

One of the most concrete points in the timestamps is the rewrite of the Messages API in Rust (56:05 "Rebuilding the Messages API in Rust"), motivated, according to the flow of the conversation, by CPU constraints as the platform grew (53:25 "CPU constraints and scaling"). Replacing the layer that receives and routes every model request with a more efficient stack is the classic decision for anyone going from thousands to millions of calls per day.

For teams consuming Anthropic's API via SDK, this rewrite is invisible in the usage contract, but it explains why latency and the ability to handle traffic spikes have room to improve without a model version change. It's separation of responsibility again: the model evolves at one pace, and the serving infrastructure evolves at another.

Opus 5.5 and the business context

The episode also covers the Opus 5.5 launch, with notes on model behavior, evaluation, and pricing, as well as distillation and "preserved thinking" (a technique for keeping the model's intermediate reasoning between distillation steps). The recorded intro to the episode also covers Anthropic's S-1, the document filed for its public offering, used to contextualize metrics such as revenue per employee and what the hosts call the "improvement and investment loop."

This financial backdrop helps explain the pressure behind the Rust rewrite and the containment architecture: a platform that becomes an API product at IPO scale can't depend on an improvised harness. The brain/hands separation is, in this sense, both a security decision and a business decision.

What this changes for agent builders

For the dev building an agent with Claude, GPT, or an open model via MCP, the episode's practical takeaway isn't "use Claude Managed Agents" (even though that is Anthropic's commercial offering). It's that the architecture separating decision from execution has stopped being a luxury for teams with a dedicated security staff and has become a prerequisite for running agents with any irreversible action in production.

In practice, this translates into three design decisions:

• The model never receives raw credentials; it requests an action, and a separate layer decides whether to execute it.
• The state of a long task lives outside the context window, not just in the accumulated conversation.
• Sandboxing and network control are treated as infrastructure, with their own deployment and versioning, independent of the model.

For stacks like Supabase or Convex, which already offer serverless function layers and row-level security, it's possible to build this separation without relying on a managed service: the function becomes the harness, the database policies become part of the sandbox, and the model is restricted to calling specific endpoints via MCP or function calling. The work of modeling this is what the episode describes Anthropic doing at scale, and that any team can replicate at a smaller scale before trusting an agent with a real action in production.