LangChain's Managed Deep Agents Get a Browser They Hand Back to You at the Login Page

A lot of the work people want agents to do lives on websites with no API: booking a trip, cancelling a subscription, filing a claim. LangChain’s latest Managed Deep Agents release gives agents a real browser for those jobs, and a way to hand it to a person when a password is needed. Managed Deep Agents v0.10 shipped on October 29, 2026, in public beta, alongside asynchronous subagents that run long tasks without blocking the conversation.

Managed Deep Agents is LangChain’s hosted way to build and deploy agents in LangSmith without running infrastructure. Developers write the agent’s instructions and tools, and LangSmith runs the harness and runtime. Version 0.8, released in September, focused on memory and credentials; 0.10 is about letting agents act.

A remote browser in its own sandbox

Turning the browser on takes one declaration. A project exports a browser from browser.py at its root, using define_browser(scope="thread", idle_ttl_seconds=600). LangChain runs that browser in its own LangSmith sandbox, separate from the agent, and stops it after the idle timeout, 10 minutes by default, so nobody pays for an unused session.

Scope decides what carries over. With the default scope="thread", every conversation starts with a fresh browser and no cookies or logins from other threads. With scope="user", a signed-in person gets one browser whose state is shared across their conversations, though each thread gets its own window so two runs do not click over each other.

The agent drives it with four tools added automatically. browser_snapshot reads the page’s accessibility tree and labels interactive elements with IDs. browser_run acts on the page, either with batches of actions such as click and fill, or with JavaScript against a Playwright-style page object. browser_screenshot captures the rendered page, and browser_handoff passes control to a person.

LangChain says the tools are built on Stagehand, Browserbase’s open-source SDK for browser agents. In its own tests on 100 tasks from the WebVoyager benchmark, the company reports a 90% pass rate for $1.98 in total, the highest of seven toolsets it tried. It says the closest, Browserbase’s MCP server, passed 89% at nine times the cost.

The handoff keeps passwords out of traces

The design choice that stands out is what happens at a login wall or a two-factor prompt. Instead of asking for credentials, the agent calls browser_handoff with a reason. In LangSmith Studio and channels such as Slack, the person gets a link to the same live browser, signs in themselves and clicks Hand back. LangChain’s point is that the password never ends up in the model’s messages, in traces or with a model provider.

Handoff returns immediately, so the agent can do other work while it waits, and handoff links expire after 15 minutes. Combined with user scope, a sign-in carries over to later threads, so the agent asks once.

The browser also has a private link to the agent’s sandbox. When it opens localhost:5173, the request reaches port 5173 inside the agent’s sandbox, so a coding agent can start an app, click through a signup form and check what renders without a public URL. LangChain says it uses this in Open SWE, its coding agent, and that passing steps can be saved as an ordinary Playwright test file that later replays with no model calls.

Subagents that stop blocking the conversation

Before v0.10, subagents in Managed Deep Agents ran inline: the main agent called one and waited, and so did the user. Now a subagent definition can set "async": True. The orchestrator starts it on its own thread, keeps talking, and can check on, update or cancel the task with a set of async task tools. Every served agent also gets a background copy of a general-purpose subagent, so it can decide at runtime whether delegated work runs in the foreground or the background.

Async subagents notify the agent rather than being polled. If the agent is busy, it checks unfinished tasks before each model call. If idle, the subagent wakes it with a new run. If it is paused on an approval, the result waits until the user answers. Async subagents share the agent’s sandbox and files, and their runs appear under the parent run in LangSmith.

Slack threads, stop buttons and breaking changes

A new runtime.thread record tracks where a thread started and who is on it, so scheduled runs and finished subagents reply in the original Slack thread. Slack threads get a Stop button, and an experimental onEvent handler decides what each Slack event starts.

There are breaking changes: connectors.mcp() and the connectors/ layout are gone, MCP servers must be declared in tools/mcp.py or tools/mcp.ts, and the sandbox scope option has been removed.