Intel / article

LangChain Managed Deep Agents gain browser use with human handoff

Source: docs.langchain.com
Author: LangChain
Date: Published Oct 29, 2026

Context

LangChain has given agents built on its Managed Deep Agents service a browser they can drive, so an can act on websites that offer no public API: booking a restaurant reservation, following links across sites for research, or testing an app through its interface after a code change. The agent can navigate, click, fill forms and inspect the result, and the service runs the browser and its tools itself. The documentation still tells developers to use a direct API when one supports the task. The feature lands in Managed Deep Agents, which LangChain opened as a public beta earlier.

A developer turns the browser on by exporting a browser declaration from a file at the project root, and the agent then gets four tools automatically. browser_snapshot reads the active page's accessibility tree and assigns IDs to its elements; browser_run navigates and acts on those IDs, or runs JavaScript; browser_screenshot captures the page; and browser_handoff gives a person control of the window. The declaration also sets the browser's scope. Under the default thread scope, each conversation gets its own browser, so a test-account login made while iterating on an app in one thread does not carry into another. Under user scope, each authenticated person gets one browser across conversations, with a separate window per thread and shared cookies and logins, so signing in to a booking site once can carry over to a new reservation request. An idle browser stops after 600 seconds by default, adjustable from 60 to 86,400.

Handoff is how the agent gets past logins, CAPTCHAs and two-factor checks without anyone typing a password into chat. The agent calls browser_handoff with a reason, and the person gets an embedded browser or a link; in LangChain's Studio it appears as a card reading "The agent needs you in the browser." The person enters credentials directly on the website and clicks Hand back. The agent is notified, inspects the page to check whether the login worked and continues the task. While the person holds control, the agent's browser tools cannot act on that window, and the handoff link expires after 15 minutes.

The documentation also spells out what these browsers do not protect against. Anyone with a valid handoff link can control the browser, so links have to stay private. User scope shares login state rather than isolating accounts: logging out or switching accounts in one thread can affect the same person's other threads, and LangChain advises coordinating purchases and bookings across conversations. Finishing a run does not log the browser out, and the docs describe browser scope as "not a password vault."

Key takeaways · AI-distilled

Thread scope, the default, gives each conversation its own browser with no cookies or logins from other threads; user scope gives each signed-in person one browser that shares logins across their threads.
LangChain warns that user scope shares login state rather than isolating accounts: logging out or switching accounts in one thread can affect that person's other threads, so purchases and bookings need coordinating across conversations.
When a site needs login, CAPTCHA or two-factor input, the agent calls browser_handoff and the person signs in directly in the browser rather than in chat; the agent's browser tools cannot act until control is handed back.
Handoff links expire after 15 minutes and anyone holding a valid link can control the browser, so LangChain says to keep them private and never put passwords in prompts, chat or agent-written files.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Read the source docs.langchain.com