Anthropic scheduled Claude agents and credential vaults delete the boring infra

Claude agents used to die when you closed the tab. That was the punchline in every agent pilot postmortem I read last year.

On June 9, 2026, Anthropic shipped two features that target the unglamorous plumbing: scheduled deployments and environment variables in vaults, both in public beta on the Claude Platform. Dynamic workflows in Claude Code (parallel subagents that write their own orchestration) went GA the same week. Together, they read less like chat upgrades and more like infrastructure you can deploy.

I build applied AI systems for clients who care about credentials, uptime, and who gets paged at 2 a.m. This is the kind of release that changes my default architecture sketch.

What actually shipped

Anthropic's managed agents blog post breaks the update into three lanes:

The headline pair for production teams is schedule plus vaults. Scheduling answers "who starts the agent when nobody is online?" Vaults answer "how does it log into anything without leaking secrets into prompts?"

Scheduled deployments: cron without the cron server

A scheduled deployment bundles an agent, environment, optional files, GitHub repo, memory stores, vaults, a cron expression, timezone, and initial_events that kick off each run.

When the schedule fires, Anthropic starts a new session and the agent completes the task autonomously. You can pause, resume, archive, or trigger manual runs through the API.

Customer examples from the launch blog:

• Rakuten runs weekly or monthly spreadsheet analysis into reports and decks, plus production log monitoring for PMs who do not want to build dashboards.
• Actively AI replaced in-house scheduling infrastructure for cross-account agentic search that refreshes on a cadence.
• Ando bundles hiring and sales follow-ups into one agent that watches channels and nudges next steps.

That Actively AI quote is the one I keep circling. One team deleted scheduling infra they had built themselves. That is the boilerplate this kills.

API shape I would actually use

The beta header is managed-agents-2026-04-01. Deployments are created at POST /v1/deployments with a cron expression and IANA timezone. Minute-level granularity is the max; Anthropic may add up to 10 seconds of jitter per schedule.

curl -fsSL https://api.anthropic.com/v1/deployments \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-beta: managed-agents-2026-04-01" \
  -H "content-type: application/json" \
  -d '{
    "name": "Weekly compliance scan",
    "agent": "agnt_...",
    "environment_id": "env_...",
    "initial_events": [
      {"type": "user.message", "content": [{"type": "text", "text": "Run the weekly compliance scan."}]}
    ],
    "schedule": {
      "type": "cron",
      "expression": "0 20 * * 5",
      "timezone": "America/New_York"
    }
  }'

Full reference lives in Anthropic's scheduled deployments docs.

Vaults: placeholders in the sandbox, real keys at egress

Vaults store environment variables and credentials for Managed Agents. At runtime the agent sees placeholders. The real secret attaches at the network boundary, only on requests to domains you allowlisted when registering the key.

That design matters for two reasons I see in client security reviews:

1. Prompt injection cannot exfiltrate a key the model never received. The agent might still misbehave, but it is not holding the raw credential in context.
2. Rotation is operational, not a redeploy drama. Update the vault; running sessions pick up the new value on the next outbound call.

Anthropic lists CLIs that work with HTTP header auth: Browserbase, KERNEL, Notion, Ramp, Sentry, and others. Browserbase and KERNEL also give Managed Agents browser capabilities through authenticated CLIs, not just API wrappers.

Notion's public API lead quoted the security win directly: roll out the Notion CLI alongside MCP without handing API tokens to agents. Browserbase uses vault-backed browse CLI plus scheduled deployments to validate a public skills catalog on a cadence.

If your agent needs to call private APIs through a shell, vault env vars are the pattern I would standardize on before writing another "fetch secret from env and paste into tool JSON" hack.

Dynamic workflows in Claude Code (GA)

The digest bundled a third item: dynamic workflows in Claude Code are now generally available. Claude writes an orchestration program on the fly, then runs separate agents with clean context windows and focused jobs.

That is the dev-side mirror of scheduled Managed Agents. Code repo work gets parallel subagents; production ops gets cron plus vaults. Same bet: stop treating the model as a chat box and start treating it as a worker you deploy.

If you have not read my earlier notes on parallel subagents in Claude Code, the practical lesson is unchanged: give each worker one job, one interface, one artifact. Parallelism without a shared spec is how you get four conflicting button components.

When I would retire my own scheduler

I still run custom schedulers for clients when:

• The workflow spans systems Anthropic's sandbox cannot reach under their egress policy
• We need sub-second triggers or complex DAG dependencies cron cannot express
• Compliance requires on-prem execution with no cloud agent runtime

For everything else (nightly CRM hygiene, weekly compliance scans, daily digest generation, log anomaly triage), I would prototype on scheduled deployments first in 2026.

Checklist before you migrate:

What I would ship first

If I were onboarding a new client this week, I would pick one boring recurring job:

1. Define the agent and environment in Claude Console.
2. Register vault credentials with tight domain allowlists.
3. Create a deployment with a conservative cron (weekly, off-peak).
4. Trigger a manual run, inspect the session trace, then enable the schedule.

Start with a job where a missed run is annoying, not catastrophic. Expand once you trust pause/resume and vault rotation.

Agents that run while you sleep only help if someone reviews artifacts on a human schedule too. Scheduling removes the "remember to kick off the agent" tax. It does not remove accountability.

If you are wiring production agents and want a second pair of eyes on vault boundaries or cron design, book a free discovery call. I spend most of my week on exactly this kind of ops plumbing.