How Deep Agents Run Untrusted Code Without a Sandbox

LangChain's Deep Agents introduced the Code Interpreter pattern, where instead of invoking subagents individually, it directly writes and executes a short script that orchestrates them. However, code written by an agent can be exposed to attacks such as Prompt Injection, making security essential.

To address this, LangChain defined three design requirements.

• Execution isolation: Isolating agent code so it cannot compromise the host system
• Capability isolation: Restricting access to only permitted data and operations
• Durable pauses: Pausing execution for human intervention and resuming later

For implementation, WebAssembly (WASM) is used to build strong in-process memory boundaries. WASM provides independent linear memory that cannot directly access the host process's memory, guaranteeing execution isolation.

To execute code inside WASM, the lightweight JavaScript engine QuickJS is used. QuickJS is a small, fast engine written in C that is compiled to WASM and runs inside the isolated boundary, efficiently handling the orchestration logic written by the agent.