# Anthropic split its agent to cut start time 90% _Anthropic said decoupling the harness from the sandbox cut time to first token by 90% and moved credentials out of execution to block prompt injection._ **Published:** 2026-10-16 **Source:** https://www.startuphub.ai/ai-news/technology/2026/anthropic-split-its-agent-to-cut-start-time-90 --- [AI Engineer](https://www.youtube.com/watch?v=Uv0nAf_7tyU) carried a session where Priyanka, who leads the engineering team for Claude managed agents at [Anthropic](/startups/anthropic), said a new architecture that decouples the brain from the hands cut time to first token by about 90%, compared with the December early-access design that bundled everything in one container. The fix was to make every part replaceable. Priyanka described three interfaces. The session is an append-only log of every event. The brain is the harness and Claude running outside the execution environment. The hands are sandboxes, VPC connections and MCP tool calls provisioned on demand and torn down when work ends. Credentials never enter the sandbox, she said. When a tool needs a token, the call routes through a proxy that injects it, so a prompt injection cannot make the model print or exfiltrate secrets. That addresses a remote attacker who controls a prompt or tool output, not a local attacker with container access, and it applies to sessions built with the v1 environments and agent and session APIs demoed. The team framed the earlier design as a pet, in the old infrastructure sense of a hand-tended, irreplaceable host, Gabe Semach said, versus cattle that can be replaced. Debugging required streaming into the container, customer data lived on the host, and connecting to a customer VPC meant peering networks or shipping the harness. The new split makes failures look like tool errors to Claude, which can respawn a sandbox or resume a harness from the log. Priyanka said the append-only log also lets the team change compaction without rewriting history, by choosing whether to summarize the full log or only the last n events for context. Harnesses encode assumptions, Priyanka argued, and assumptions go stale. She cited Sonnet 4.5 and what the team called context anxiety, where the model tried to wrap up early near the context limit and needed a harness-side reset, while Opus 4.5 did not need that workaround. The implication, compared with bundled approaches often seen with OpenAI Agents SDK tooling or Microsoft AutoGen-style local harnesses, is to keep the interface stable while swapping harness logic, though [Anthropic](https://www.startuphub.ai/ai-news/prediction-markets/2026/ai-ipo-odds-openai-vs-anthropic) did not publish comparative latency or cost numbers for those systems. What the numbers do not show is the cost of retaining the full event log, the retry rate for sandboxes, or token overhead for compaction. One implementation detail absent from the talk but present in Anthropic docs is that the intended operational shape is to define the agent as a version-controlled file and sync it with ant apply, which records the ID in claude-lock.json, per the managed-agents overview in the Anthropic skills repository. That shifts the demo of a console-built joke-teller agent into a Git-controlled workflow for teams. A single controlled test of failure rates and spend per session would change the read on whether cattle actually lowers operating cost. The open question is whether moving credentials out of the sandbox and making sandboxes disposable reduces blast radius enough in production, or whether the extra service boundaries simply move failure modes to the proxy and log store. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory. © StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.