What Happened
Recent releases show agent tooling moving beyond basic tool calling toward execution control, evaluation and security. Semantic Kernel’s Python 1.46.0 release rejects unsafe upload paths, pins HTTP plugin requests to validated DNS addresses, and fixes tool-result and connector behavior; its .NET changes also bound XML prompt nesting and reject unsafe upload paths [1].
A separate agent-tooling release adds evaluation timeouts, loop detection, PostgreSQL-backed spend limits, ag-ui-protocol 1.0 support and an interactive Python code mode. It also changes defaults for dynamic tool catalogs and periodic model reminders [2]. Another release adds conversational-flow context compaction and fixes issues involving deserialization, SQL injection, path traversal and dependencies [3].
Why It Matters to Businesses
Framework selection now affects more than developer speed. An agent that can search data, execute code or call business APIs needs bounded costs, observable decisions and explicit authority. A release that changes tool discovery or conversation replay can alter production behavior even when application code stays the same [2]. Security fixes to paths, HTTP requests and deserialization illustrate why framework upgrades belong in the application’s security process [1][3].
The tools serve different starting points: LangChain and LlamaIndex are commonly used for model, tool and retrieval integration; LangGraph for explicit stateful workflows; AutoGen and CrewAI for multi-agent coordination; PydanticAI for typed agent interfaces; DSPy for optimizing model-driven programs; and Semantic Kernel and the OpenAI Agents SDK for their respective application and provider ecosystems. Claude Code is primarily a coding agent, not a substitute for an application runtime. These are design distinctions, not evidence that one framework is universally better.
Kimbodo Engineering Perspective
Choose the control model before the framework. For a predictable business process, an explicit workflow with a small number of agentic steps is usually easier to test and audit than open-ended delegation. Use multi-agent coordination only when distinct roles measurably improve outcomes. Keep domain rules, permissions and durable business state outside prompts so a framework can be replaced without rewriting the application.
How We Would Implement It
- Define permitted tasks, tools, data classifications, approval points and success metrics before selecting an SDK.
- Put model and framework calls behind application-owned interfaces. Use a stateful workflow where retries, checkpoints or human approval are required; expose retrieval through a separately tested service.
- Give each tool a narrow schema and least-privilege credentials. Validate inputs and outputs, constrain network destinations, and require approval for irreversible actions.
- Record traces, tool calls, costs and outcomes. Evaluate representative tasks—including loops, empty results and provider failures—before rollout; set time, step and spend limits [1][2].
- Pin versions and test upgrades against those evaluations, especially when defaults, replay behavior or security-sensitive integrations change [1][2][3].
Risks, Costs and Security
Primary costs are model usage, tool infrastructure, evaluation and operational review—not just framework licensing. Long-running loops and expanding context can raise spend; compaction and spend limits help but can also discard information or stop useful work [2][3]. Treat retrieved content and tool results as untrusted, isolate code execution, protect secrets, and review framework advisories and dependency updates. No agent framework removes the need for application-level authorization, auditability and incident response.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our Enterprise AI Agent Development practice, or Scope an Enterprise AI Agent.
Sources
- [1] python-1.46.0
- [2] v2.63.0 (2026-10-27)
- [3] 1.15.31
