In this blog post Microsoft Agent Framework 1.x October 2026 Changes Explained we will examine why a routine AI framework update can unexpectedly interrupt workflows, invalidate stored sessions or weaken controls around sensitive business tools.
Microsoft Agent Framework is the software layer used to build AI agents that can remember conversations, call business systems and complete multi-step tasks. Rather than simply answering questions, these agents might review a document, check a customer record, request approval and update another system.
That capability is useful, but it also creates risk. Once an agent can access files, execute tools or retain business data, framework changes affect more than the development team. They can influence operational continuity, security, compliance and the cost of supporting the system.
What was released during October 2026
October was not defined by one large release. Microsoft delivered four Python releases and four .NET releases in just over three weeks.
CPI Consulting helps organisations design, build and secure Azure AI solutions, from Azure OpenAI and Microsoft Foundry to agents, governance and production deployment.
Visit CPI Consulting- Python 1.20 on 2 October
- Python 1.21 on 8 October
- Python 1.22 on 15 October
- Python 1.23 on 22 October
- .NET 1.23 on 1 October
- .NET 1.24 on 7 October
- .NET 1.25 on 14 October
- .NET 1.26 on 23 October
As at 29 October 2026, Python 1.23 and .NET 1.26 are the latest October releases. However, “latest” does not automatically mean “ready for your production environment”.
We previously covered the detailed readiness questions around Python 1.21 and .NET 1.24. The more important month-end question is what the full October release sequence means for your operating model.
Security boundaries became more explicit
The clearest direction across the October releases is that Microsoft is making developers state where trust begins and ends. This matters because many early AI projects assumed that anyone reaching an agent was already authorised to use every tool connected to it.
Python 1.23 now requires AG-UI endpoints to declare an authorisation scope or confirm that they are for a single user. AG-UI is the connection between an agent and its user-facing application. Making that trust model explicit reduces the chance of one user accessing another user’s agent session or tools.
The same release renamed a Docker shell setting to make its unsafe nature clearer. In plain English, Docker shell tools allow an agent to run commands inside an isolated software container. They can be powerful, but they should never be treated as harmless simply because they run inside a container.
For Australian organisations, these changes support the broader control environment expected under Essential 8, the Australian Government’s cybersecurity framework. They can strengthen access control, application control and audit practices, but installing a new framework version does not make an AI system Essential 8 compliant by itself.
Stored agent data needs an upgrade plan
Python 1.22 introduced an important warning about persisted state. Persisted state is the information an agent saves so it can resume later, including conversation histories, workflow checkpoints and session snapshots.
Some serialised data created by different framework versions may not be interchangeable. This becomes dangerous during a rolling deployment, where half your servers run the old version while the other half run the new one.
Imagine a 180-person professional services firm using an agent to prepare client onboarding packs. The agent pauses while a manager approves a risk classification, then resumes later. If the upgraded server cannot correctly read the saved checkpoint, the process may restart, fail or repeat an action.
The business impact is not merely an error message. Staff may need to reconstruct work manually, clients may receive duplicate requests, and the organisation may lose a reliable record of who approved what.
Before upgrading, decide whether active sessions will be completed, migrated or deliberately discarded. Our version governance guide explains how version pinning and staged testing protect production state.
MCP 2.x changes how Python agents manage connections
Python 1.23 moved its Model Context Protocol support to the MCP 2.x client lifecycle. MCP is a standard way for AI agents to connect to tools and data sources without creating a completely different integration for every system.
The newer lifecycle gives the MCP software more responsibility for connection negotiation, repeated requests, caching and subscriptions. That should improve reliability over time, particularly for agents connected to several tools.
It is also a breaking change for some applications. If your code creates and manages its own MCP connection, that connection now needs to remain open for the complete agent or workflow run. Older connection patterns may continue temporarily as compatibility paths, but they do not receive all the newer behaviour.
This is why MCP upgrades require end-to-end testing. A connection may start successfully yet fail when an agent performs a second tool call, waits for approval or resumes a long-running task. Teams using agent-to-agent communication should also review our A2A and MCP governance guide.
Operations and cleanup received useful improvements
The October .NET releases included several smaller changes with meaningful operational value. .NET 1.26 added a standard way to delete stored agent sessions, improved warnings when declarative actions are unsupported and fixed OAuth consent handling for connected tools.
A declarative action is an agent step described through configuration rather than custom code. Logging a warning when such an action cannot run helps support teams find configuration problems before they become unexplained business failures.
Session deletion is equally important. Organisations need a defined way to remove expired, incorrect or privacy-sensitive agent records. This is relevant to retention policies and Australian Privacy Act obligations, particularly where prompts contain employee, customer or financial information.
Do not allow automatic production upgrades
With eight releases during October, leaving package versions open can cause a tested application to behave differently after a routine rebuild. Production systems should use approved, fixed versions.
# Python production dependency
agent-framework==1.23.0
<!-- Central .NET package version -->
<PackageVersion Include="Microsoft.Agents.AI" Version="1.26.0" />Pinning does not mean staying on an old version forever. It means choosing when an upgrade happens instead of allowing the build system to choose for you.
For teams managing frequent releases, the practical approach in our Australian release cadence guide is to separate evaluation, pre-production and production environments.
What technology leaders should do now
- Confirm every deployed version. Record the Python and .NET framework versions, hosting packages, connectors and MCP dependencies currently in use.
- Identify saved state. Locate conversation histories, sessions, workflow checkpoints and snapshots before approving an upgrade.
- Test real business journeys. Include approvals, failed tool calls, restarts, session deletion and long-running work rather than testing only a simple question.
- Review agent permissions. Confirm which users can access each agent and which files, commands and business systems it can reach.
- Keep a rollback path. Retain the previous application build and a protected copy of stored state until the new version is proven stable.
The business takeaway
October’s releases make Microsoft Agent Framework more capable and more suitable for controlled business use. They also reinforce a simple lesson: production AI agents must be operated like business applications, not treated like experiments.
CloudProInc combines more than 20 years of enterprise IT experience with hands-on expertise across Azure, Microsoft 365, OpenAI, Claude, Microsoft Defender and Wiz. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations test the whole agent environment, including identity, data access, cloud security and recovery.
If you are unsure whether an October Agent Framework upgrade could affect your production agents or stored data, we are happy to review the setup and give you a practical view of the risks, with no strings attached.