LangChain says Managed Deep Agents add credentials through a proxy outside the sandbox, only for calls to services the user has allowed. The agent never sees the token, so a malicious package running in the sandbox cannot expose it.
Agents with sandboxes run packages you didn't write. If one is malicious, any credential in the sandbox is exposed.
With Managed Deep Agents, the proxy adds your token outside the sandbox, only on calls to services you've allowed. The agent never sees it.
A walkthrough of how Managed Deep Agents uses sandbox proxies to keep your credentials safe. https://langch.in/mda
Source: LangChain · x.comPublished
