--- title: "The Managed-Agent Landscape: Twelve Ways to Not Run Your Own Agent" pubDatetime: 2026-07-08T00:00:00.000Z description: "By mid-2026 the managed-agent market has settled into three layers of hosted runtimes, all selling the same promise. Here's the map, what you're actually buying, and the isolation label that BeyondTrust showed you shouldn't trust." tags: [agents, managed-agents, platforms, security, landscape, 2026, 2026-q3, 2026-07] --- > [!tldr] TL;DR > The "managed agent" market has hardened into three layers: hyperscaler runtimes ([AWS Bedrock AgentCore](https://aws.amazon.com/about-aws/whats-new/2025/10/amazon-bedrock-agentcore-available/), GA October 2025; Vertex AI Agent Engine; Azure AI Foundry Agent Service, GA May 2025), framework-native platforms ([LangGraph Platform](https://www.langchain.com/blog/langgraph-platform-ga), GA May 2025; OpenAI AgentKit; Anthropic's [Claude Managed Agents](https://claude.com/blog/claude-managed-agents), April 2026), and sandbox runtimes (E2B, Modal, Fly.io, Cloudflare, Vercel). All sell the same pitch: stop babysitting infrastructure, ship the agent. What you buy is the plumbing (durable state, memory, identity, tracing), which is genuinely worth buying. What you inherit is their isolation model, and BeyondTrust showed that even AWS's Firecracker-backed "sandbox" leaked command-and-control over DNS. Buy the plumbing, audit the sandbox label yourself, keep an exit ramp. When Anthropic shipped [Claude Managed Agents](https://claude.com/blog/claude-managed-agents) on 8 April 2026, the announcement called it a first of its kind. The [top reply on Hacker News](https://news.ycombinator.com/item?id=47693047) pointed at LangSmith and asked what everyone was thinking: LangChain shipped this a year ago, so what am I missing? The answer is that nobody is missing anything. The managed-agent runtime is now a commodity with roughly a dozen vendors, and the interesting question stopped being "who has one" some time in 2025. So here is the map, because a market this crowded is easier to reason about once you know the shape. ## Three layers Orca Security's [runtime roundup](https://orca.security/resources/blog/the-best-ai-agent-runtime-tools-platforms-in-2026/) sorts the field into three layers, and the split holds up. From most managed to least: | Layer | Examples | What it hosts | Isolation model | |---|---|---|---| | **Hyperscaler runtime** | Bedrock AgentCore, Vertex AI Agent Engine, Azure AI Foundry Agent Service | Your agent code, framework-agnostic, plus memory + identity + gateway | Managed session isolation (microVM or container) | | **Framework-native** | LangGraph Platform, OpenAI AgentKit, Claude Managed Agents | Agents built in that vendor's framework, deployed with one command | Container / vendor infra | | **Sandbox / serverless** | E2B, Modal, Fly.io Machines, Cloudflare Agents, Vercel Sandbox | Raw compute for agent-generated code | microVM (Firecracker), container (gVisor), or V8 isolate | The dates tell you how fast this filled in. Azure AI Foundry Agent Service and LangGraph Platform both hit GA in [May 2025](https://www.infoq.com/news/2025/05/azure-ai-foundry-agents-ga/). Bedrock AgentCore went to [preview in July 2025 and GA on 13 October](https://aws.amazon.com/blogs/aws/introducing-amazon-bedrock-agentcore-securely-deploy-and-operate-ai-agents-at-any-scale/). Vertex AI Agent Engine reached GA and [started billing](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/release-notes) for sessions, Memory Bank, and code execution on 28 January 2026. Claude Managed Agents was the straggler, in April. Fourteen months, three layers, full board. ## What you're actually buying The model call is the cheap part and everyone knows it. The value in a managed runtime is the surrounding plumbing, and it's the same short list at every vendor: - **Durable execution.** An agent that runs for twenty minutes and survives a process restart needs checkpointing. LangGraph Platform makes this its headline; AgentCore and Agent Engine bake it into the runtime. - **State and memory.** Sessions, conversation history, a long-term memory store. Vertex's Memory Bank and AgentCore Memory are separate billable services precisely because this is the piece people don't want to build. - **Identity and tools.** AgentCore routes permissions through IAM; Azure uses Entra ID. The agent gets a scoped identity and an MCP-compatible gateway to reach tools. - **Observability.** Traces, evals, replay. LangSmith for the LangChain stack, built-in dashboards everywhere else. That's a real offer. If you've hand-rolled session persistence and a tool broker, you know it's a few weeks of unglamorous work that the runtime hands you for a usage fee. The counter-argument showed up in the same HN thread, from someone who builds agents for a living: "I don't see much of an appeal. I didn't find it that difficult to set up the infrastructure. The hard part was getting the agents to do exactly what I wanted." The plumbing was never the bottleneck; the behaviour was. A managed runtime solves the easy problem well and leaves the hard one entirely with you. That's fine, as long as you're honest about which problem you're paying to remove. ## The lock-in everyone can smell The louder theme in that thread was strategic. One commenter read the whole move plainly: "Anthropic wants to shift developers onto their platform where they're in control. The fight for harness control has been terribly inconvenient for them. To score a big IPO they need to be a platform, not just a token pipeline." This is the [harness-commoditisation](/posts/agent-harnesses-standard) story running in reverse. If the harness is a commodity, the model vendors have every reason to pull you up a layer, into a runtime where the harness is theirs and the switching cost is real. You can feel the pull in the pricing fine print. Claude Managed Agents works with your own harness, another commenter noted, but only on pay-as-you-go, not the $20 plan. The managed runtime is where the account, the memory, and the identity live, and once your agent's state is in Vertex's Memory Bank or AgentCore's store, "just move to another provider" is a migration, not a config change. One HN reader called the category by its eventual name: "The next $100B business model in 2026 is AaaS. Agent as a Service." The sharpest line in the thread was a warning, not a joke: "Managed agents sounds like progress, but also like we're standardizing around the current limitations instead of solving them." Worth pinning to the wall. ## The isolation label you shouldn't trust Here's where a landscape piece on this blog earns its keep. Look back at the isolation column in that table. It ranges from Firecracker microVMs down to shared V8 isolates, and the marketing word "sandbox" papers over all of it. When an agent runs code that a prompt injection wrote, that column is the only thing standing between "contained" and "compromised." In September 2025, [BeyondTrust's Phantom Labs](https://www.beyondtrust.com/blog/entry/pwning-aws-agentcore-code-interpreter) tested the strongest option on the board. AgentCore's Code Interpreter runs inside Firecracker microVMs, the same isolation that powers Lambda, and BeyondTrust's own writeup applauds that choice while noting that other agent-as-a-service vendors don't isolate nearly as hard at the compute level. Then they broke it anyway. AgentCore's "Sandbox" network mode, advertised as "complete isolation with no external access," still allowed outbound DNS queries. A and AAAA lookups are enough to build a command-and-control channel and exfiltrate data one label at a time, straight through the isolation boundary. The disclosure timeline is the part to remember. Reported to AWS on 1 September 2025. Acknowledged 22 October. On 23 December, AWS said it [would not fix](https://www.beyondtrust.com/blog/entry/pwning-aws-agentcore-code-interpreter) the behaviour and would instead edit the docs to tell customers who want real isolation to use VPC mode. AWS finally remediated the DNS tunnel on 15 April 2026, seven months after the report and only after the research went public. An earlier [Sonrai study](https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/) had already shown credential exfiltration through the same environment's metadata service. Sit with the shape of that. The best-isolated managed runtime in the market shipped a mode called "Sandbox," told customers it had no external access, and left a covert channel open for months after being shown the exploit. The vendors lower down the isolation column are running gVisor containers or shared isolates, where the failure modes are worse and cheaper to reach. And the entry condition for all of it, code execution inside the sandbox, is exactly what an agent hands an attacker the moment a [poisoned tool result or injected instruction](/posts/ai-agent-security-lethal-trifecta) reaches a model with a code interpreter attached. That is the [lethal trifecta](/posts/ai-agent-security-lethal-trifecta) with the compute layer included in the subscription. ## What to actually do Buy the plumbing. Durable execution, managed memory, a scoped identity, and real tracing are worth the usage fee, and rebuilding them yourself buys you nothing but maintenance. Pick the layer that matches how much control you want to keep: hyperscaler runtime if your data and IAM already live there, framework-native if you've standardised on LangGraph or a single model vendor, raw sandbox if you want the isolation primitive and nothing else. Then do the two things the marketing hopes you'll skip. Read the isolation model, not the word "sandbox," and if the vendor won't tell you whether it's a microVM or a shared container, treat the answer as "shared container." Test the network boundary yourself, because AWS's own docs were wrong about theirs for months. And keep an exit ramp: know where your agent's state lives and what it would take to move it, before the memory store fills up and the migration gets expensive. The runtime is a commodity now, which is good news. The isolation underneath it is not commodity-grade yet, whatever the pricing page implies. Buy the first, verify the second. --- **Sources** - Orca Security: [The Best AI Agent Runtime Tools & Platforms in 2026](https://orca.security/resources/blog/the-best-ai-agent-runtime-tools-platforms-in-2026/) - AWS: [Introducing Amazon Bedrock AgentCore](https://aws.amazon.com/blogs/aws/introducing-amazon-bedrock-agentcore-securely-deploy-and-operate-ai-agents-at-any-scale/) and [AgentCore is now GA](https://aws.amazon.com/about-aws/whats-new/2025/10/amazon-bedrock-agentcore-available/) (13 October 2025) - LangChain: [LangGraph Platform is now Generally Available](https://www.langchain.com/blog/langgraph-platform-ga) (14 May 2025) - Microsoft / InfoQ: [Azure AI Foundry Agent Service GA](https://www.infoq.com/news/2025/05/azure-ai-foundry-agents-ga/) (May 2025) - Google: [Vertex AI release notes](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/release-notes) (Agent Engine sessions, Memory Bank, code execution billing from 28 January 2026) - BeyondTrust Phantom Labs: [Pwning AWS Bedrock AgentCore's AI Code Interpreter](https://www.beyondtrust.com/blog/entry/pwning-aws-agentcore-code-interpreter) - Sonrai Security: [Sandboxed to Compromised: credential exfiltration in AWS code interpreters](https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/) **Coverage and discussion** - HN: [Claude Managed Agents](https://news.ycombinator.com/item?id=47693047) (169 points, 87 comments) - Anthropic: [Claude Managed Agents announcement](https://claude.com/blog/claude-managed-agents) **Related on this blog** - [The agent harness is becoming a commodity](/posts/agent-harnesses-standard) - [Three indirection steps from a reverse shell](/posts/ai-agent-security-lethal-trifecta) - [Twenty-two second brains, and a text file that beats most of them](/posts/second-brain-ai-memory-landscape) - [The Ralph Wiggum technique](/posts/ralph-wiggum-technique)