The Microsoft Lab That Worked on AutoGen Is Over. AutoGen Already Gets No Security Fixes

• Book: Event-Driven Architecture Pocket Guide
• Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
• My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
• Me: xgabriel.com | GitHub

---

"So AI Frontiers is over." That's the plainest line in The End of AI Frontiers, the post John Langford, who helped create the Microsoft Research group, published on November 6.

AI Frontiers was a group of "~50 people" inside Microsoft Research, and its agent work included "the Autogen orchestration framework and the Fara computer use agent." If a Python service of yours runs a multi-agent setup on AutoGen, that sounds like the moment to worry.

The awkward part is that Microsoft had already told you to stop. Three weeks before Langford's post, a README change merged on October 16 put this at the top of the AutoGen repo: "Microsoft is not providing bug fixes, security fixes, new features, or support for this project."

What Langford wrote

Langford writes that the group was set up inside Microsoft Research after ChatGPT came out, to run research in a more coordinated way (hunch.net). "In early September we were reorged into Microsoft AI," he writes, and he describes Microsoft AI's leadership as focused on scaling, which he saw as incompatible with the group's research focus. He says he "situated my folks as best I could and left," and explains why he didn't go back to Microsoft Research. He adds that "there will not be internships with the folks there in the coming year."

Besides the agents, the post lists fundamental research from the group's New York team: the Next Latent objective, Dion3 (an improved Muon optimizer) and the Full Bandwidth Transformer (hunch.net).

The post doesn't say what happens to AutoGen or Fara, or to the people who maintain them (hunch.net). The Fara repo is MIT-licensed and not archived; its last push was September 22 (GitHub API). For AutoGen, the README change came first, so the rest of this post works from the repos and docs as they stand today.

The research group is over. The code it worked on is still on GitHub.

AutoGen stopped getting fixes before this

AutoGen has been winding down for more than a year. The last release of autogen-agentchat on PyPI is 0.7.5, uploaded on September 30, 2025. The README sends new users to Microsoft Agent Framework, which it calls "the enterprise-ready successor to AutoGen."

The October 16 change went further than the old maintenance banner. The description of pull request #8366 says it adds "explicit language stating that AutoGen is archived and no longer maintained by Microsoft," and a later commit in the same pull request adds that AutoGen was never intended for production use. The README now warns that vulnerabilities may go unaddressed and advises against production use (README).

GitHub doesn't treat the repository as archived, and that can fool a dependency audit: its API still reports "archived": false (GitHub API), so there is no read-only banner. On the repo, the README text is the clearest signal, and a tool that checks the archive flag will miss it.

Langford's post doesn't change AutoGen's status. If you were hoping the research group around it would revive it, by his account that group no longer exists.

First, find out which AutoGen you run

"AutoGen" on PyPI means more than one project. Microsoft's packages have a hyphen, such as autogen-agentchat and autogen-ext, the two the migration guide imports from. The plain autogen package is a different project: its metadata points to AG2 and the ag2ai/ag2classic repo, not to Microsoft (PyPI). Its page says that package gets only security and critical bug fixes, and that active development is in ag2 (PyPI).

Check the environment your service actually runs in:

python -m pip list 2>/dev/null \
  | grep -iE '^(pyautogen|autogen|ag2|agent-framework)'

If the hits start with autogen-, the README's warning is about you. The same goes for pyautogen: its PyPI page now calls it "a proxy package for the latest version of autogen-agentchat." If you only see autogen or ag2, you're on AG2, a separate project this news doesn't touch.

What changes in Agent Framework

Microsoft shipped Agent Framework 1.0 on April 3, 2026, for .NET and Python. The migration guide says it is "developed by the core AutoGen and Semantic Kernel teams at Microsoft." The current Python package on PyPI is agent-framework 1.25.0.

The basic shape carries over. This pair comes from the guide, rewrapped to fit:

# AutoGen (autogen-agentchat)
agent = AssistantAgent(
    name="assistant",
    model_client=client,
    tools=[my_tool],
)
result = await agent.run(task="Help me with this task")

# Microsoft Agent Framework
agent = Agent(name="assistant", client=client, tools=[my_tool])
result = await agent.run("Help me with this task")

Four defaults differ, all from the guide:

• AssistantAgent is single-turn unless you raise max_tool_iterations. Agent is multi-turn by default and keeps calling tools until it has a final answer, so a port can make more model calls per request than the code it replaces.
• Agent is stateless between calls. AutoGen's AssistantAgent kept conversation history in its state; in Agent Framework you carry it in an AgentSession.
• Teams become a Workflow: a typed graph that routes messages along edges, with checkpointing and request/response pauses. The guide says it was inspired by AutoGen's experimental GraphFlow.
• AutoGen offers embedded and experimental distributed runtimes. Agent Framework focuses on single-process composition, and distributed execution is still planned.

Porting the agent class is the easy part; the tool loop and session state are where behavior changes.

If you call Claude, check provider support before you plan the sprint. The guide's client table, dated October 23, still marks Anthropic and Ollama as "Planned" (Microsoft Learn). The repo already has anthropic and ollama packages, and PyPI lists agent-framework-anthropic only as a beta: 1.0.0b261106, uploaded on November 7. pip skips pre-releases unless you ask for them:

pip install agent-framework
pip install --pre agent-framework-anthropic

Hand the port to an agent, one branch at a time

A migration like this suits a coding agent: it's mechanical, the guide documents it side by side, and your tests can check it. It's also a change you want to review turn by turn, because a changed default like the tool loop doesn't always show up as a failing test.

I build Hermes IDE, so weigh this with that in mind. In Hermes, ⌘N (Ctrl+Shift+N on Windows and Linux) starts each task on its own hermes/<name> branch in its own worktree, with the task as the agent's first prompt (README). You can give the same port to Claude Code in one task and Codex in another and compare. The Review Desk (⌘G, or Ctrl+Shift+G) shows the changes by turn or by file, and you can diff or restore any single turn (README). I haven't run this AutoGen migration myself.

Hermes's Review Desk in By turn view: two turns of a Claude Code task, the first turn's diff of src/db.ts, and a commit message drafted from the turns.

Hermes is free to download, source-available under BSL 1.1, and runs on macOS, Windows and Linux. It isn't affiliated with Microsoft, Nous Research or any agent vendor named here.

If you run AutoGen in production today, are you porting to Agent Framework, moving to AG2, or dropping the framework layer altogether? Tell me in the comments.

---

If this was useful

AutoGen's core was an event-driven runtime, and Agent Framework's workflows route messages between steps and resume from checkpoints. Once agents talk through messages, the old distributed-systems questions come back: what happens when a step runs twice, or a resume replays a message. The Event-Driven Architecture Pocket Guide covers those patterns, from sagas to the outbox. If you hand the port to a coding agent, Hermes IDE keeps each attempt on its own branch, and it's on GitHub.