The agent runtime is being pulled onto your infrastructure, piece by piece

Three separate Anthropic changes over about two weeks point the same direction, and none of them announced themselves as a strategy.

Claude Code 2.1.238 added claude self-hosted-runner --defer-shutdown-max-min, which keeps serving attached sessions on SIGTERM, parks whatever's left after the deadline, then exits. That's a rolling-deploy flag. You don't ship a graceful drain option unless people are running your runner in a deployment pipeline they control. The same release added --proxy-authorization-command and --proxy-authorization-file for egress proxies that demand a freshly minted Proxy-Authorization header per connection, and stopped the server from evicting a runner after one slow poll and handing its healthy session elsewhere. Claude Code changelog

Second: as of August 19, Managed Agents sessions running in a self-hosted sandbox can attach memory stores. The Python, TypeScript, and Go SDK workers download each attached store into the sandbox at its mount_path and sync changes back. Claude Platform Release Notes

Third, and earliest: the August 6 self-hosted environments beta, where every connection is outbound HTTPS to api.anthropic.com and Anthropic never dials into your network. Anthropic

Line those up and the shape is clear. Inference stays with the model provider, because it has to. Execution moved. The filesystem moved. Persistent memory just moved. What's left on the vendor's side of the wire is a token stream.

If you're designing an agent deployment right now, the design rule I'd write down is this: the runtime boundary is yours to place, the inference boundary is not. Every piece of the agent that isn't the forward pass can live where your security team can see it, and vendors are actively building the flags to let you do that. A year ago the honest answer to "can I run this in my VPC" was no. Now the answer is "yes, except the model," and the remaining question is just whether your compliance posture can live with outbound HTTPS to one endpoint.

The market is selling this layer independently too, which is usually the sign that a boundary is real. Plow Latch launched today at #7 on Product Hunt selling scoped Mac access for agents, where the agent gets only the tools and credentials it needs, data stays local, and a second adversarial LLM watches for the first one going rogue (Product Hunt). Dockhand at #5 ships a self-hosted Docker control plane with CVE scanning and 1Password/Vault secret injection, free for personal use, with a companion MCP server so an agent can drive it (Product Hunt). Agent least-privilege stopped being a config file and became a product category.

I'll flag the thing I can't resolve. Pulling the runtime onto your infra makes exfiltration harder and makes your misconfiguration the failure mode. The LocalAI 4.9.0 release this week is the cautionary version: they had to make authentication deny-by-default after unprefixed routes like /moderations, /models, and /mcp/chat/completions were found bypassing the protected-prefix check entirely (GitHub). Self-hosting moves the risk. It doesn't delete it.