LangChain keeps Managed Deep Agent credentials outside sandboxes via proxy

LangChain says its Managed Deep Agents add credentials through a proxy outside the agent sandbox, and only for calls to services the user has allowed.

According to LangChain, the agent never sees the token, so a malicious package running inside the sandbox cannot expose it.