Anthropic has quietly enabled self-hosted execution environments for Claude Code, and the distinction matters more than the marketing suggests. This isn't about running the model on your own hardware—the weights still live in Anthropic's infrastructure. What moves onto your network is the session orchestration layer: where Claude Code runs its tool calls, accesses repositories, and interacts with your internal services.

How Self-Hosted Execution Actually Works

The architecture separates two concerns that cloud-hosted Claude Code previously bundled together. The AI model inference continues hitting Anthropic's API endpoints, but the agent runtime—the part that reads your codebase, executes shell commands, and calls tools—now runs inside a container you control. Think of it as putting a local proxy between Claude's reasoning engine and your sensitive infrastructure.

What Stays in the Cloud (And Why It Matters)

Here's the part vendors sometimes gloss over: Anthropic still sees your prompts, conversation history, and tool call metadata through their API. The model runs on their GPUs. Their telemetry systems still log interaction patterns for safety filtering. Self-hosted execution doesn't mean a zero-trust architecture—it means you've moved one specific slice of the stack onto your infrastructure while keeping the core AI processing cloud-native. This hybrid approach reflects pragmatic engineering rather than any architectural breakthrough. Running 70B+ parameter models requires GPU clusters that most enterprises don't want to maintain, yet those same enterprises have legitimate concerns about sending proprietary codebase context through third-party APIs. Anthropic's solution threads this needle by letting customers control the execution environment while still leveraging their hosted model infrastructure.

Security Implications for Enterprise Teams

For security-conscious organizations, the value proposition centers on tool access patterns rather than data residency guarantees. Claude Code with self-hosted execution can authenticate against your internal systems using credentials that never leave your network—GitHub enterprise instances, Jira deployments behind corporate firewalls, private npm registries. The agent still reasons through Anthropic's API, but its actions execute locally.

Key Takeaways

  • Self-hosted execution moves Claude Code's runtime onto YOUR network—model inference still hits Anthropic's cloud
  • Your proprietary code and internal API calls stay within your data center during session execution
  • Prompts, conversation context, and tool metadata still flow through Anthropic's infrastructure
  • Best fit for enterprises with strict tool access requirements but limited appetite for self-hosting large models

The Bottom Line

This is a thoughtful compromise that serves real enterprise needs without requiring Anthropic to abandon their cloud-hosted model business. Whether it works for your organization depends on whether the threat model you're protecting against involves code exfiltration through Claude's execution layer—or something else entirely.