this is the part of the deep agents production series i've been most excited to get to: sandboxes without an execution environment, a produc…

this is the part of the deep agents production series i've been most excited to get to: sandboxes without an execution environment, a production agent is only as capable as its fixed toolset. give an agent an execution environment where it can write and run code, and you give it a general-purpose toolkit for approaching complex and diverse problems. that's what sandboxes unlock. think data analysis: an agent that can write and execute its own queries, process the results, and generate a report is fundamentally more useful than one that can only call a predefined analysis tools. deep agents handles this through sandbox backends. configure one and the agent gets an execute tool scoped to that environment. no backend, no tool. deep agents is provider-agnostic: daytona, modal, runloop, and langsmith sandboxes all supported, swappable with a config change. secure code execution requires isolation: code running on your host can read env vars, exfiltrate api keys, cause real damage. but the sandbox protects your host, not the sandbox itself. credentials placed inside are still reachable via prompt injection. the auth proxy pattern addresses this: credentials live in workspace secrets, get injected on outbound requests by a sidecar, and never land inside the execution environment. https://docs.langchain.com/oss/python/deepagents/sandboxes

Source: Harrison Chase (X) | 2026-05-07