Managed Deep Agents v0.10: Browser Use and Async Subagents

Most browser agents stall at a login wall or a two-factor prompt, and the usual workaround puts a password where the model and its traces can see it. LangChain’s Managed Deep Agents v0.10 hands the browser window to the person instead. For teams building agents that book, cancel or file things on sites with no API, that handoff matters as much as the browser itself.

What Happened

LangChain’s release post says v0.10 of Managed Deep Agents is in public beta with two headline features.

Browser use. Declaring a browser in a project’s browser.py runs one in its own LangSmith sandbox and adds browser tools to the agent automatically. LangChain’s case is that fetching a page with curl returns HTML before JavaScript renders, and the agent can’t click anything. By default each conversation gets its own browser with no cookies or logins from other threads. With scope=“user”, each signed-in person gets one browser whose logins carry across their conversations, so they sign in to a site once.

When the agent hits a login, it calls browser_handoff with a reason. Slack and Studio show a link that opens the remote browser with a Hand back button. The person signs in, hands back, and the agent checks whether the login worked. Handoff returns immediately, so the agent can do other work while it waits, and links expire after 15 minutes. LangChain cites DataDome seeing agentic browser requests jump 4.7x in September.

Async subagents. Subagents used to run inline, so the user waited while one worked. Adding async to a subagent definition runs it on its own thread while the orchestrator keeps talking. The agent gets tools to start, check, update and cancel those tasks, and every served agent gets a background copy of the general-purpose subagent. Subagents notify the agent when they finish, so there’s no polling: a busy agent picks up the result before its next model call, an idle one is woken with a new run, and one paused on an approval gets the result after the user answers. Async subagents share the agent’s sandbox, so they see files it already wrote.

Why It Matters

The release also tidies up how agents live in Slack. Every thread records where it started, so a scheduled run or a subagent finishing hours later replies in the original Slack thread. Slack threads get a Stop button that cancels their runs. A resolveUser hook maps a verified Slack sender to a user in your own system, so tools can check that person’s permissions.

There are breaking changes. connectors.mcp() and the connectors/ layout are gone, so MCP servers must be declared in tools/mcp.ts or tools/mcp.py. The sandbox scope option is removed, and shell LANGSMITH_* variables now override a project .env.

What This Means for Builders

The handoff design keeps credentials out of prompts and traces, which removes the most obvious risk of letting an agent sign in for someone. The trade-off is scope: a user-scoped browser keeps logins across conversations, so any session can act on every site that person has signed in to. Thread scope is the safer default for agents that touch accounts.

Async subagents fix a real usability gap but add a new one. Results can arrive in the middle of another run, and Stack Archive’s look at how Deep Agents manages context rot shows why extra tool output landing mid-conversation needs watching.

Source: LangChain Blog

Content created with AI assistance and reviewed for accuracy.