The Brain/Hands/Session split is a pattern, set out by Anthropic in Scaling Managed Agents: Decoupling the brain from the hands, for building a long-running AI agent by separating it into three components that can each fail or be replaced independently. The Brain is Claude together with its harness, the loop that calls the model and routes its tool calls. The Hands are the sandboxes and tools that perform actions. The Session is an append-only log of everything that happened. Each becomes an interface that makes few assumptions about the others.
Usage
The pattern is the architecture of Claude Managed Agents. Anthropic explains it by analogy with operating systems, which virtualized hardware into abstractions such as the process and the file that outlasted the hardware beneath them: it aims to be “opinionated about the shape of these interfaces, not about what runs behind them,” because harnesses encode assumptions about what Claude cannot do on its own and those assumptions go stale as models improve. Its example is a harness that added context resets to counter Context Anxiety in one model, only for the behavior to be gone in a later model, leaving the resets as dead weight.
Anthropic describes having first run all three components in a single container, which made that
container a “pet” in the pets-versus-cattle sense: if it failed the session was lost, debugging meant
opening a shell in a container that often held user data, and the harness assumed every resource sat next
to it. After decoupling, the harness calls the sandbox like any other tool (execute(name, input) → string), so a failed container becomes a tool-call error and a new one can be provisioned; and because
the session log sits outside the harness, a failed harness can be rebooted with wake(sessionId), fetch
the log with getSession(id) and resume from the last event. Anthropic reports that provisioning
containers only when needed dropped time-to-first-token by roughly 60% at p50 and over 90% at p95, and
that the same separation lets one brain work with many hands and many stateless brains be started at
once.
The Session also changes how long contexts are handled. Anthropic distinguishes it from Claude’s context window: rather than making irreversible decisions about what to keep, as Compaction and context trimming do, the session durably stores every event and lets the harness select slices of it, while any transformation before events reach the model is left to the harness.
Addy Osmani’s overview of long-running agents describes Google’s Gemini Enterprise Agent Platform as architecturally the same brain/hands/session split, productized at platform scale and bundled with a development kit rather than assembled by a team from scratch (see Gemini Enterprise Agent Platform).
When It Applies
- Conditions. Anthropic presents the pattern for hosting long-horizon agents, where a durable event log outside the harness is what makes a run recoverable after a container or harness failure, and where an agent may need to reach execution environments beyond a single shell.
- Assumptions. It assumes the model can reason about several execution environments and decide where to send work. Anthropic notes that it started with a single container because earlier models were not capable of this.
- Security. Separating the sandbox from the harness is how Anthropic keeps credentials unreachable from the sandbox where Claude’s generated code runs, so that a prompt injection cannot simply read them from the environment; Git tokens are wired into the sandbox’s remote at initialization and MCP credentials are fetched from a vault by a proxy.
- How established. It is one vendor’s account of the design of its own hosted service, with performance figures from that service; Osmani’s overview treats the split as the pattern underlying several managed agent runtimes.
Related Terms
Long-running Agent, Meta-Harness, Agent Harness, Claude Managed Agents, Gemini Enterprise Agent Platform, Anthropic