Building Scheduled Agent Automations on Claude Managed Agents

An agent that runs unattended on a schedule fails differently from one you watch, and this guide from Anthropic's Lance Martin and CJ Avilla, which ClaudeDevs shared on X, is mostly about those failures. Its reference implementation runs on Claude Managed Agents, a beta service that hosts agents on Anthropic's infrastructure so nothing has to stay running on your machine. The agent reads chosen Slack channels and GitHub pull requests at 7:32 on weekday mornings, New York time, and posts a dated brief to one Slack channel. The setup is a handful of configuration files that the ant command-line tool turns into resources, and a Claude Code command can walk you through writing them. Every run starts in a fresh sandbox with no memory of the last one, so the design centres on what each run leaves behind for the next and on making silent failures visible.

Rather than reading a fixed window such as the last 24 hours, which leaves a gap after a late run and repeats items after an early one, the agent saves a bookmark per source: the timestamp of the newest item it read, kept in a memory store the platform mounts into every run. If a source fails, for instance because the server connecting it to GitHub is down or its token has expired, the run still starts without those tools and would otherwise report a quiet day; the instructions keep that source's bookmark in place and end the brief by naming what could not be read. Posting follows the same caution. The agent first checks whether today's edition is already in the channel, counts a post as sent only when Slack returns "ok": true and a message timestamp, and only then updates its bookmarks and its ledger of reported items. An unclear result is logged as "maybe posted" with nothing else changed, because recording a post that never landed would skip those items for good, while posting again out of doubt would send readers the same brief twice. Just before posting, it also re-checks each item's live status and drops anything it cannot confirm.

Because the agent reads text other people wrote, the guide treats instructions planted in that text as a real possibility and limits what obeying them could do. Credentials sit in a vault outside the sandbox where the agent's code runs; the sandbox holds only a placeholder for the Slack token, and the platform substitutes the real one as a request leaves for an allowed host. The GitHub token and the preferences store are read-only, and the sandbox can reach only allowlisted hosts. The authors are explicit about what this leaves open: a planted instruction can still change what the brief says, including through the notes the agent keeps between runs, and Slack is the exception because the same token reads and posts, so the bot should be invited only where it needs to be. Each run also has a spending cap; they suggest starting at three to five times a normal run's cost, because a run that hits the cap pauses rather than failing, so a cap set too low looks like a brief that simply went quiet.