When Kimi and Zhipu Both Clone Claude, Is the Managed Agent API War Already Over?

For the past three years, the first line of code in most large language model applications was an HTTP request to /v1/chat/completions. OpenAI unified the entire industry around that single stateless endpoint. By 2026, however, engineering requirements have shifted. Developers now need models to run continuously in the cloud for 40 minutes, read and write across more than a dozen spreadsheets, and pause mid-run while waiting for an internal corporate database to return results. Early stateless question-answering endpoints can no longer support long-horizon workloads like these.

On November 5, 2026, Moonshot AI published the official Kimi Hosted Agents documentation, opening public beta access to endpoints that had been running since September 3. A service where the model provider hosts the execution loop, tool invocations, and container sandbox in the cloud on your behalf is known as a managed agent. Developers simply define the agent role and send or receive events, without maintaining servers or handling retry logic themselves. Reading through its API reference alongside Zhipu AI’s previously launched official Zhipu Z Managed Agents documentation reveals a striking convergence: when building cloud-hosted managed agents, both leading Chinese foundation model providers passed on following OpenAI’s /v1/responses and instead replicated Anthropic’s April 8, 2026 official Claude Managed Agents documentation line by line—from route structures and resource prefixes down to the event state machine.

Why Did Heavyweight Managed Agents Clone Claude Instead of Following OpenAI?

Before examining cloud APIs, we need to distinguish local protocols from public cloud protocols. OpenAI’s Codex App Server runs over local standard input/output or persistent local connections to manage editor extensions and command-line processes. Setting aside those single-machine inter-process communication protocols, if we look at public-facing, multi-tenant cloud APIs over the internet, they fall into two distinct camps.

The first camp is OpenAI’s single-endpoint continuation model, where every request hits the same URL and chains multi-turn conversations together by passing the previous turn’s identifier via previous_response_id. OpenAI launched the OpenAI Responses API documentation on March 11, 2025, and shut down the legacy Assistants API on August 26, 2026. Groq and the MiniMax Responses API documentation followed suit. This design treats an agent as a stateful inference request where the server conveniently runs web search or a code interpreter on the side. It works well for lightweight interactions spanning a few turns, but quickly hits walls on complex enterprise tasks lasting 30 minutes or longer: developers cannot pre-install custom team packages into the container or restrict outbound domains, cannot call external APIs without exposing plaintext secrets to the model, risk overwriting files when multiple sessions edit the same workspace concurrently, and cannot have a cloud agent reach back into a corporate intranet to invoke internal tools.

The second camp is Anthropic’s four-primitive control plane. It decomposes a managed agent into four decoupled API resources: Agent to define roles and tools, Environment to define the container runtime, Session to represent a single execution instance, and Events to record the bidirectional event stream of every step. Zhipu and Moonshot align closely with Anthropic at this layer. Across all three providers, the four core routes—/v1/agents, /v1/environments, /v1/sessions, and /v1/sessions/{id}/events—share identical names, container skills are mounted read-only under /mnt/agents/skills/, and event streams rely on transitions between active and idle states to drive local callbacks. On cloud sandbox pricing, Moonshot pushed active container billing down to 0.072 RMB/hour (with idle time and self-hosted workers free, plus a 100 RMB trial credit for new users)—roughly one-eighth of Anthropic’s $0.08/hour (about 0.58 RMB/hour).

The loop control program wrapping a model is commonly called a Harness, responsible for feeding prompts, parsing tool calls, managing sandbox files, and retrying on errors. We published our Claude Managed Agents architecture analysis on April 8, 2026, and predicted in our April 18 article on the canonical form of an agent harness that while providers would converge on these four conceptual primitives, achieving API-level compatibility across state machines and event granularity would prove difficult. Just seven months later, industry reality proved that prediction wrong. Because major Chinese model providers had already adopted full compatibility with the /v1/messages endpoint to serve Claude Code users, ecosystem inertia—combined with the absence of a heavyweight public-cloud protocol from OpenAI—propelled Claude Managed Agents into the de facto standard for domestic managed agent services.

When Enterprise Data Cannot Leave the Intranet, How Does a Managed Sandbox Connect?

Once the API surface is clear, architects face the next practical hurdle. According to the Kimi Environments documentation, each cloud session provisions a Debian 12 container by default with 4 vCPUs, 8 GiB of RAM, and 16 GiB of disk, pre-installed with Python 3.12, Node 24, Go, Rust, a headless browser, and office suites. If both the harness and the container run in the cloud, how do enterprises protect internal databases and third-party commercial API keys?

Moonshot provides a three-tier security and hybrid execution model around this protocol. The first tier substitutes credentials at the cloud sandbox’s outbound proxy layer so the model never sees plaintext secrets. The encrypted resource where enterprises store third-party keys is called a credential vault, corresponding to Vault in the API. According to the Kimi Vaults documentation, in /v1/vaults environment-variable mode, $CRM_TOKEN inside the container is merely a dummy placeholder—even if the model runs a command to print environment variables inside the sandbox, it cannot see the real secret. Only when an outbound request targets a whitelisted domain in allowed_hosts and passes through the sandbox egress proxy does the proxy inject the actual credential.

The second tier uses local tool callbacks so sensitive tools remain inside the corporate intranet. As detailed in the Kimi Tools documentation, a tool that queries a core financial ledger can be declared as a custom tool kept on-premises. When the cloud model reaches that step, it emits an agent.custom_tool_use event and suspends the session into an idle state (with stop reason requires_action). Once the local client finishes executing the tool inside the intranet, it pushes the result back to the cloud via user.custom_tool_result to resume the loop. According to the Kimi Pricing reference documentation, sandbox fees are paused while a session is suspended.

The third tier is self-hosted long polling, moving the entire container inside the intranet. For enterprises with the strictest compliance requirements, Moonshot replicated Anthropic’s ant beta:worker poll mechanism with the kha worker poll command. An enterprise launches a worker process on an internal host that initiates outbound long polling to pull instructions from the cloud, without opening any inbound firewall ports.

Built on the same foundation, the two domestic providers have diverged in their product evolution. In the Kimi Plugin Marketplace documentation, Moonshot integrated over 30 vertical data plugins billed across four tiers from 0.02 RMB to 0.70 RMB per successful call, spanning web search, Xiaohongshu and Douyin social media, CNINFO corporate filings, and patent and business registration data. It also added on-demand tool loading—injecting only a brief catalog on the first turn and pairing it with select_tools to load tool definitions dynamically so dozens of plugins do not blow up the context window. Meanwhile, through the Kimi Dreams memory consolidation documentation, Moonshot exposed /v1/memory-stores/{id}/dream-policy, turning Claude Code-style background memory consolidation into a cloud API backed by SHA256 optimistic locking that automatically merges fragmented memories after every five modified sessions by default. Zhipu, on the other hand, extended its glm-5.3 model family with /v1/deployments and /v1/channel/*, enabling direct QR-code binding for personal WeChat accounts as well as Feishu and WeCom integrations.

With This Cloud Foundation in Place, How Do Multi-Agent Design and Long-Horizon Costs Work in Production?

After seeing how Moonshot uses the four-primitive API to deliver cloud sandboxes, credential isolation, and intranet tool execution, the natural next question is: once developers move real workloads onto Kimi’s managed foundation, how should they structure complex long-horizon tasks, and what does execution actually cost? Moonshot shipped 12 official industry reference templates alongside this release. Two heavyweight examples in particular—the official Fund Reconciliation Agent use case and the official Financial Modeling Agent use case—show that how Moonshot itself uses this platform looks very different from the practice, popular over the past two years, of splitting workflows into a dozen small step-by-step agents.

The first takeaway comes from the Fund Reconciliation Agent case, which shows that spawning sub-threads is primarily about trust and permission isolation. In this workflow—which takes 15 to 25 minutes per run and costs roughly 15 RMB in total—the official template uses the /v1/sessions/{id}/threads endpoint to split execution across three roles. Why split it this way? Because as native model reasoning grows stronger, the benefit of carving a workflow into business steps via separate role prompts continues to shrink. Just one day earlier (November 4, 2026), Surge AI published its Coding Agent Harness benchmark report, showing that across 89 tasks on Terminal-Bench 2.0, keeping the minimal loop Terminus 2 unchanged while simply raising GPT-5.4 reasoning effort from medium to xhigh boosted accuracy by 11.3 percentage points to 66.0% (whereas swapping five different Harness implementations at a fixed medium effort yielded only a 3.2 percentage-point spread). Conversely, the Superpowers framework—which packs 37 built-in skills into complex prompts and spawns up to 17 sub-agents on a single task—consumed 4.4x to 9.9x as many tokens, took 3.6x longer, and saw its score drop to 53.5% (a 1.2 percentage-point regression). This aligns with the same-day (November 5) Mistral Studio platform announcement consolidating core platform primitives, as well as the broader depreciation of hand-crafted workflows we examined in our ByteDance Coze Enterprise shutdown analysis.

If splitting workflows by business step no longer pays off, the reason Kimi’s official template still uses /threads to spawn three agents is to enforce security boundaries at the operating-system and API levels. Custodian bank statement PDFs arriving from external parties are untrusted inputs that could conceal malicious prompt injections: 1. Custodian Statement Parser Sub-Agent (Low-Trust Zone): At the API level, it is granted only read_file permission, with ipython, shell, write_file, and network access completely disabled. Even if an external PDF hides malicious instructions, the sub-agent can neither execute code nor inspect the internal ledger. 2. Main Agent (High-Trust Reconciliation Zone): Mounted with the reconciliation skill and granted ipython plus file read/write permissions, it compares the parsed output against the internal valuation sheet. 3. Independent Auditor Sub-Agent (Blind-Audit Zone): Deliberately stripped of the reconciliation skill so it cannot rationalize or repeat the main agent’s flawed assumptions. The system forces it to report the raw files’ total row counts and first/last security codes (file_fingerprints), and to randomly sample at least 20 primary keys (spot_check) from records the main agent marked clean for manual recalculation. Enforcing physical permission boundaries and blind auditing at the infrastructure layer is something a model cannot replicate through internal reasoning alone.

The second takeaway comes from the Financial Modeling Agent. On top of a cloud-managed foundation, the cost savings of prefix caching finally materialize in practice. As we demonstrated in our June 25, 2026 article on KV cache hit rates as the primary agent cost lever and our September 3 three-ledger analysis of caching discounts, 85% to 95% of the bill in multi-turn agent workloads goes toward repeatedly re-reading prior context, making the Prompt Cache hit rate the single largest lever governing cost. Whenever a homegrown framework accidentally scrambles dynamic prompt ordering or a load-balancing gateway routes requests across different inference replicas, cache miss rates spike and bills spiral out of control. Moonshot’s Financial Modeling Agent completes this picture from the cloud provider’s vantage point: for tasks that do not require isolating untrusted external inputs, Moonshot lets a single main agent run continuously for 45 to 90 minutes across 60 to 120 tool-calling turns, totaling up to 10 million input tokens. A glance at the cost breakdown shows where a managed foundation actually saves money: running the cloud sandbox for 1.5 hours costs only about 0.1 RMB (at 0.072 RMB/hour), whereas the real savings come from tight coordination between the managed orchestration layer and underlying inference routing, keeping the Prompt Cache hit rate at 95%. On kimi-k3, cached prefix tokens drop from 20 RMB per million tokens to 2 RMB per million tokens (a 90% discount), compressing a single modeling run that would otherwise exceed 200 RMB down to 30–50 RMB.

How Should Engineering Teams Structure Their Code Today?

With API protocols converging and value boundaries coming into focus, engineering teams kicking off new projects can choose their integration strategy directly by task complexity. For lightweight question answering or simple retrieval within a few turns, calling the single-endpoint /v1/responses continuation API remains the lowest-friction path.

When workloads involve sandbox execution, long-horizon multi-turn loops, or hybrid intranet tool calls, building clients and adapters around the four-primitive control plane—Agent, Environment, Session, and Events—is the stronger bet. Now that Anthropic, Zhipu, and Moonshot have aligned at this protocol layer, writing application code against these abstractions minimizes future migration costs across leading domestic and international models. And when designing multi-agent systems, teams can retire the old habit of slicing prompts into product manager, coder, and tester personas: leave standard long-horizon tasks to a single high-reasoning model backed by a managed cloud platform’s 95%+ Prompt Cache hit rate, and reserve /threads sub-agents for cases that genuinely require isolating untrusted data permissions or enforcing an independent blind audit.