Anthropic rewrote the Messages API in Rust and put credentials out of its agents' reach

Anthropic had Claude rewrite the entire Messages API in Rust and finished rolling it out in production last week. The people who run Claude Platform described it on the Latent Space podcast. For agent builders, though, the bigger lesson is how the company separates an agent's brain from its hands and from its secrets.

A Rust port validated on shadow traffic cut CPU by 40 to 50 %, Anthropic says

Katelyn Lesse leads engineering and Angela Jiang leads product for Claude Platform. Their 107-minute Latent Space interview was recorded the day after Opus 5.5 launched. According to the guests, a year ago the Messages API ran as a Python monolith in a single Google Cloud region. Last week Anthropic fully replaced it with a Rust version.

The method is more interesting than the language. The team had no experienced Rust developers. Humans designed the architecture and the verification, and Claude wrote the code. The result was a fork of the whole API, which the team fed with shadow traffic while checking that the Python and Rust versions returned the same outputs. The guests estimate CPU savings of 40 to 50 % and a 10 to 20 % improvement in time to first token. They called these ballpark figures.

The second topic is distillation. Researchers showed how to extract reasoning traces from proprietary models, and Anthropic closed the gap. It now requires thinking blocks to be preserved across turns. That breaks third-party harnesses, especially those with their own context compaction. According to the interview, Anthropic shipped compaction in the API itself and reached out to open source harness maintainers in advance.

Managed Agents separate the brain from the hands and from the credentials

The most practical passage for developers is about Claude Managed Agents. The harness, the agent's brain, runs on a durable server. The hands, a sandbox or container that executes code, are created only when needed. If the sandbox dies, the agent survives. The first version was simply Claude Code in a sandbox with an API on top. Startup was slow, and when the container died, the whole agent went with it.

Security came almost as a side effect. Credentials for MCP servers, CLIs or APIs live in a separate vault. The agent only sees a placeholder. A proxy injects the real credential on the way out. The sandbox can also have a domain allowlist or no network at all. Code the agent writes and runs has nothing to steal and nowhere to send it.

The lesson applies to anyone building their own agent runtime. Ask three questions. What must survive a crash? What runs untrusted work? Which secrets really need to sit where code executes? Many homegrown setups still pass tokens into the container as environment variables.

Anthropic blames sandbox escapes on training, and independent checks are missing

This is still a vendor talking about its own product. The CPU and latency numbers were offered as estimates, with no methodology and no breakdown by workload. The transcript is automatic, speakers are not identified in it, and Latent Space itself warns that names and wording may be off.

The argument about sandbox escapes also deserves caution. The guests say the incidents people read about involve models in training, where an agent gets an impossible task and has a reason to break out of the box. In production, they say, online safeguards and a separated architecture are in place. The distinction makes sense. But prompt injection in production does not need the model to be motivated; untrusted input is enough. A separate vault protects credentials. It does not protect data the agent can legitimately access.

A stateful Messages API and the cost of preserved thinking will decide it

The guests hinted at the next step: a Messages API that holds the state of a long conversation itself, so the client no longer resends the entire history. For long agent runs, that would save time and bandwidth. Conversations would also stay on Anthropic's servers longer, and EU companies will have to ask how long and where that data is retained.

The second signal is operational. Watch how often harnesses break on the requirement to preserve thinking blocks and whether compaction in the API is cheaper than homegrown versions. They also acknowledged that CPU is now scarce for Anthropic and virtual machines can't be added on demand. That will show up in Managed Agents limits and pricing before it shows up in any podcast.

Lilith's verdict

Anthropic put its agent in a room with no passwords lying around, and a proxy hands over the real credentials only at the exit. Anyone still passing tokens into a sandbox as environment variables is leaving a wallet right next to code the agent just downloaded from the internet.