Does a LangGraph subagent inherit its parent's tool permissions? I tested it.

A supervisor with one tool spawned a Deep Agents writer that ran an attacker's web search. LangChain's docs say that's by design. Twelve lines of middleware stop it. Real output, versions pinned.