Reviewing Microsoft Agent Framework — the AutoGen and Semantic Kernel successor

This isn't pedantry. “We built it on AutoGen” is not a complete answer to a review question in 2026 — it could mean a fixes-only legacy codebase, an actively developed community fork with a different maintainer and roadmap, or (loosely, and incorrectly) the framework that actually replaced it. Each has a different patch cadence, a different security-support commitment, and in AG2's case, a different organization entirely behind it.

Microsoft's own documentation describes Agent Framework as combining AutoGen's simple abstractions for single- and multi-agent patterns with Semantic Kernel's enterprise-grade features — session-based state management, type safety, filters, telemetry, and broad model and embedding support. On top of the merge, Agent Framework adds workflows that give explicit control over multi-agent execution paths, and a more robust state-management system built for long-running, human-in-the-loop scenarios.

For a review, the practical read is: Agent Framework inherits Semantic Kernel's more disciplined, enterprise-oriented posture (typed interfaces, telemetry, filters) rather than AutoGen's looser, research-oriented conversation model — which is a meaningfully different starting point for a security review than either predecessor had alone.

“Maintenance mode” doesn't mean inactive as an attack surface — it means the only thing shipping is fixes, and in May 2026 Semantic Kernel needed two serious ones. CVE-2026-25592 (.NET SDK) let a prompt-injected agent write arbitrary files to the host through the Python-execution plugin's file-transfer methods, which lacked path validation. CVE-2026-26030 (Python SDK) was worse in mechanism, if not universally agreed severity: InMemoryVectorStore's filter logic compiled a filter string into a Python lambda and ran it through eval() — a textbook path to arbitrary code execution. (Public CVSS scores for this one vary sharply across trackers, from 3.1 up to 9.9; the eval-based mechanism itself is not in dispute.) Both are fixed — Microsoft.SemanticKernel.Core >= 1.71.0 and python-1.39.4 respectively — but a review of any Semantic Kernel deployment still running has to confirm the patch is actually in place, not assume maintenance mode means dormant.

Microsoft's own disclosure language on the Semantic Kernel CVEs is worth quoting directly: readers should expect analogous flaws in LangChain, CrewAI, AutoGen, and other agent frameworks. That's the vendor naming this as a class-wide architectural problem, not a framework-specific lapse — useful context when a review is deciding how much weight to put on any one framework's CVE count in isolation.

Legacy AutoGen had its own scare as recently as June 2026: Microsoft's own security research team found a three-vulnerability chain in AutoGen Studio (an origin-allowlist bypass, a missing-auth localhost MCP endpoint, and an unsanitized command-execution endpoint) that let a single malicious web page instruct a browsing agent to spawn arbitrary host processes. No CVE was assigned because the vulnerable handler only ever shipped in two pre-release dev builds — but it's a concrete data point that a framework in maintenance mode is still actively receiving new findings, not a settled, low-risk legacy system.

Agent Framework ships with native support for MCP (Model Context Protocol) and A2A (Agent2Agent), alongside AG-UI and OpenAPI, letting agents built on it call external tools and coordinate with agents built on entirely different frameworks or vendors. That's a real capability upgrade — and it means every review question that applies to MCP servers and clients generally now applies directly to systems built on Agent Framework too, not just to Anthropic-ecosystem or protocol-native tooling.

See MCP security review for the full set of questions an MCP integration needs answered — tool-descriptor trust, per-action authorization, transport security — all of which now apply the moment an Agent Framework deployment connects to an MCP server. Agent-to-agent (A2A) coordination introduces the same category of question covered here for cross-vendor agent communication generally.

One place Agent Framework genuinely differs from LangChain or CrewAI: Microsoft Entra Agent ID models agent identities as first-class, non-human software identities — not reusing human authentication mechanisms — with the option to pair an agent 1:1 with a dedicated Entra agent-user account for delegation scenarios. Microsoft's stated design pattern for multi-agent systems is explicit: one identity per agent role, all sharing a common trust boundary, with agent-to-agent discovery and authorization built on standard protocols like MCP and A2A rather than a bespoke scheme. Neither LangChain nor CrewAI has an equivalent first-party enterprise identity-provider integration for individual agent roles — a concrete, checkable difference a review can verify is actually configured, not just available.

Microsoft's own security documentation is direct about where the responsibility still sits: the framework's stated first principle is to treat LLM-provided tool arguments as untrusted input and LLM responses as untrusted output — the model is framed explicitly as an external, untrusted endpoint, not a trusted internal component. Agent Framework does not claim to be secure by default; it claims to give a team the primitives to build a secure system, which is a distinction a review should hold the deployment to.

For any system in the AutoGen / Semantic Kernel / Agent Framework lineage, a design-time review should be able to answer:

• Which specific framework and version is actually deployed — legacy AutoGen, AG2, Semantic Kernel, or Agent Framework — confirmed against the dependency manifest, not team memory?
• If on a maintenance-mode framework (legacy AutoGen or Semantic Kernel), is there a documented migration plan and timeline, or an explicit decision to stay with fixes-only support?
• If on AG2, is the team tracking its independent release cadence and security advisories separately from Microsoft's own?
• Where MCP or A2A connectivity is enabled, has that integration gone through the same review as any other MCP server or cross-agent connection?
• Does the workflow model (Agent Framework's explicit multi-agent execution paths) get reviewed as a graph, the way LangGraph or CrewAI Flows would be, rather than assumed safe because it's newer?
• If Semantic Kernel is still in use, is it pinned past 1.71.0 (.NET) / 1.39.4 (Python), closing CVE-2026-25592 and CVE-2026-26030?
• Does each agent have its own Entra Agent ID scoped to its actual task, or is a shared/broad identity used across multiple agent roles?