AMD's PrimusClaw Hands Teams the Managed Agent Runtime That Logged 100,000 Agent-Hours on Its Own GPU Clusters

AMD has open-sourced PrimusClaw, a managed agent runtime that companies run on their own Kubernetes clusters instead of renting from a model provider, and it arrives with six months of production numbers from AMD’s own use. The November 6, 2026 ROCm blog post describes three pieces in one repository, AMD-AGI/PrimusClaw: a durable session store, a stateless agent harness, and a separate sandbox for each session. AMD’s documentation describes the code as MIT-licensed, except for the sandbox control plane, which it identifies as an Apache-2.0 fork of the Kubernetes SIG Apps agent-sandbox project.

The pitch is aimed at organizations that already own GPU clusters. AMD notes that Anthropic, AWS, Google, Microsoft, and OpenAI now each host agents and their state for customers. PrimusClaw keeps the harness, the event log, and the sandboxes inside the customer’s cluster, so prompts, tool results, and model traffic can stay on its own infrastructure when self-hosted models sit behind the gateway. AMD is open about the trade-off: the compliance certifications and service levels a managed service provides become the operator’s job.

Session, harness, and sandbox kept apart

The design splits a run into parts that can fail on their own. The API, built on Fastify, owns sessions, events, memory, skills, plugins, and task graphs, and stores each run as a row in PostgreSQL. The harness, called Brain, runs the agent loop and calls models through an Anthropic- or OpenAI-compatible gateway, with LiteLLM in the reference setup. Hands is an MCP tool server inside each session’s sandbox that exposes shell, file, and patch tools. Platform credentials never reach it.

Work is handed out by lease rather than pinned to a process. A message on NATS JetStream signals that a run is waiting, but carries neither its prompt nor its credentials. A Brain replica with spare capacity claims the run, and only then opens the sealed credentials. During an upgrade, old replicas stop claiming new runs, save each conversation to a checkpoint, and sync the workspace to object storage. A new replica then picks up the run from whatever survived.

Production numbers from AMD’s own clusters

AMD says two PrimusClaw deployments ran between April 20 and October 13, 2026. Together they hosted more than 40,000 sessions for more than 70 users, adding up to over 100,000 agent-hours, more than 4 million tool calls, and more than 500 billion prompt tokens. On the main deployment, the median run lasted 3.4 hours, the 99th percentile 11.5 hours, and the longest 50.1 hours.

Recovery figures are the most specific claims in the post. On the main deployment, 2,140 runs lost their sandbox partway through. The runtime rebuilt each one, and 2,047, or 95.7%, still succeeded. Across three rolling API upgrades, 580 of 583 in-flight runs completed: 544 succeeded and 36 completed with failures. AMD attributes those 36 failures to agent or sandbox errors rather than a lost worker. These are AMD’s own measurements, and outside users have not yet confirmed them.

Shared-kernel sandboxes need opt-in hardening

PrimusClaw assumes that code inside a sandbox may be hostile, since a model that read hostile input wrote it. The only credential a sandbox carries is the calling user’s own key, which AMD says should be scoped, rate-limited, and ready to revoke. The control plane refuses to start without authentication unless an operator opts out. Other protections are opt-in: session-bound five-minute tokens, an outbound proxy that blocks cloud metadata and loopback addresses, sealed checkpoints, and Kata Containers for virtual-machine isolation. AMD states that the default runc runtime shares the host kernel and is not a hard isolation boundary. Production installs also need Primus-SaFE, AMD’s open platform for cluster authentication and GPU placement.

For interfaces, PrimusClaw offers an API compatible with the Claude Managed Agents quick-start flow, tested with Anthropic’s TypeScript SDK. It also supports A2A v1.0 and MCP in both directions. Sandboxes can request AMD Instinct GPUs and boot from ROCm images, which is why AMD uses it to host its Hyperloom inference-tuning and GEAK kernel-optimization agents. Developers can try the tool layer without a cluster by running make demo on Node.js 26, which needs no GPU, model key, or network access once built.