AMD’s PrimusClaw keeps agents running on your own GPUs: 40,000 sessions so far

AMD has released PrimusClaw, an open-source managed agent runtime that runs entirely in a customer’s own Kubernetes cluster next to AMD Instinct GPUs. AMD says two internal deployments have hosted more than 40,000 agent sessions since April 2026.

Three planes, all inside your cluster

According to AMD, PrimusClaw splits an agent run into a durable session, a stateless harness that runs the agent loop (called Brain), and a per-session sandbox that executes actions (called Hands). The session store, harness, sandboxes and sandbox control plane ship in one repository. Most of the code is MIT-licensed. The exception is the sandbox control plane, which is AMD’s fork of the upstream Kubernetes agent-sandbox project and carries the Apache-2.0 license.

Each run is a PostgreSQL row. Chat turns are announced through NATS JetStream, and a harness replica claims a run by taking a lease, which AMD sets by default at 45 seconds, renewed every 15. If a replica is lost or upgraded, another can pick the run up from a checkpoint. Authentication and multi-node GPU placement are delegated to Primus-SaFE, AMD’s open-source cluster platform; production installs require it, while an isolated evaluation cluster can run without it.

For connectivity, AMD lists compatibility with the Claude Managed Agents quick-start flow, plus the A2A v1.0 protocol and MCP, which works both for calling tools and for exposing PrimusClaw’s own operations. Models are reached through an Anthropic- or OpenAI-compatible gateway, with LiteLLM in the reference setup. Sandboxes can request Instinct GPUs and start from ROCm-based images. AMD says GPU optimization agents such as Hyperloom and GEAK already run as PrimusClaw sessions.

As AMD puts it, “PrimusClaw is AMD’s open answer” to the managed agent services that Anthropic, AWS, Google, Microsoft and OpenAI now run.

Production figures that AMD reports for itself

The company says that between 20 April and 13 October 2026 its deployments served more than 70 users, logged over 100,000 agent-hours and more than 4 million tool calls, and sent over 500 billion prompt tokens to models. On the main deployment the median run lasted 3.4 hours and the longest 50.1 hours. Peak concurrency in June exceeded 800 runs.

Recovery numbers are the core claim. AMD says 2,140 runs lost their sandbox, the runtime began rebuilding each, and 95.7% succeeded. Across three rolling API upgrades, 580 of 583 in-flight runs (99.5%) ran to completion and 544 (93.3%) succeeded. The 36 failures reported agent or sandbox errors, not a lost worker, AMD says.

Idle sandboxes are reclaimed on evidence rather than a timer. A probe reads the job roster of each sandbox, and only a positive “empty” result lets the reaper act. A timeout or proxy error keeps the sandbox alive. The default idle window is 15 minutes.

Who can use it, and what comes with it

Anyone can clone the AMD-AGI/PrimusClaw repository. A demo of the layer that edits files and runs commands needs Node.js 26 and runs without a cluster, a GPU or a model key. The full stack follows a deployment guide, and the top-level installer previews its plan and changes nothing until --yes is passed. No pricing is involved; AMD does not describe any hosted offering.

The security defaults deserve a careful read. Fail-closed authentication on the sandbox control plane is on out of the box. Session-bound tokens (five-minute expiry), the egress proxy, checkpoint sealing and the Kata runtime are settings an operator must enable. Sandboxes run on runc by default, which AMD itself says is not a hard isolation boundary. The one credential a sandbox carries is the calling user’s own key, so AMD advises scoping, rate-limiting and being ready to revoke it.

A hardware vendor moves up into the agent stack

For teams that already own Instinct clusters, the practical change is that agent hosting no longer has to live with a cloud provider. With self-hosted models behind the gateway, AMD says prompts and tool results can stay on a customer’s own infrastructure. The trade-off, which the post states plainly, is that compliance certifications and service levels become the operator’s job.

The timing fits AMD’s wider push. Our earlier coverage reported that AMD’s data center sales nearly doubled to $8.5B in the latest quarter, and that AMD extracted 1.72x more throughput from MI355X for coding agents. Software that keeps long agent jobs alive on those GPUs supports that demand, and the runtime is tied closely to AMD’s own stack (Primus-SaFE, ROCm, Instinct).

The sandbox design also matters because agents are already being misused. We reported that China-linked hackers ran an AI agent swarm against 200+ targets for 11 days, according to CrowdStrike. Keeping platform credentials away from model-written code is a sensible response to that threat, but it only helps if operators turn the hardening options on.

What the source does not establish

All performance and reliability figures come from AMD’s own databases and metrics, and no outside party has verified them. The sample is small: more than 70 users, with at most nine runs executing at once during the 30 September to 13 October latency window. AMD’s comparison table with rival runtimes uses public documentation read on 13 October, and AMD notes that a dash means the documentation is silent, not that a feature is missing. Several recovery behaviors are described as “designed” to work, and unplanned failures such as node loss are covered by the same design but are not separately measured in the post. Independent deployments will show how the claims hold up outside AMD.