How to Choose Agent Frameworks for Production AI: Prioritize Security, Durability and Control

What Happened

Pydantic AI v1.107.10 and v2.66.0 address seven security advisories across its main and slim packages. The fixes cover resource exhaustion from attacker-influenced web fetches, cloud metadata credential exposure, secrets in embedding traces, denial-of-service paths involving client-submitted schemas and conversations, unsafe reconstruction of tool results, and DNS resolution before hostname rejection. Provider-native web fetching is unaffected by the high-severity web-fetch flaw. Version 2.66.0 also fixes a decision-model schema issue. [1][2]

The same release adds Azure Durable Task durability, sandbox integrations, and Pixeltable tools and memory storage. Separately, Claude Code v2.1.318 adds cross-account AWS role assumption and per-developer cost attribution, while fixing session, permission-prompt, MCP configuration, and remote-session reliability issues. Scripts that parse its self-hosted runner logs may need adjustment. [2][3]

Why It Matters to Businesses

These changes highlight a practical distinction: an agent framework is not just a way to connect a model to tools. It also determines how untrusted inputs cross boundaries, how credentials and traces are handled, and whether work can resume safely after interruption. A capable prototype can still be unsuitable for production if those controls are weak.

Kimbodo Engineering Perspective

LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, PydanticAI, DSPy, Semantic Kernel, and the OpenAI Agents SDK should be evaluated against the workload—not ranked by feature count. We would test orchestration and recovery, typed tool contracts, approval enforcement, observability, and operational fit. Claude Code is a developer-agent tool with related governance concerns, but it is not a drop-in replacement for an application runtime. The releases above provide concrete evidence of changes to Pydantic AI and Claude Code, not a basis for claiming new releases across every framework. [1][2][3]

How We Would Implement It

• Start with one bounded workflow. Define tool schemas, permitted hosts, credential scopes, approval points, and measurable success and failure cases before selecting a framework.
• Place tool execution behind a service boundary with outbound-network restrictions, cloud-metadata blocking, resource limits, and human approval for consequential actions. Test controls on tools passed into the runtime; Pydantic AI specifically notes that passed Tool instances need FunctionToolset(requires_approval=True) when approval is required. [2]
• Use durable execution only where recovery is needed. Persist minimal state, make external actions idempotent, and test retries and resumed sessions against duplicate execution.
• Redact credentials before telemetry export, restrict trace access by tenant and role, and attribute usage costs to teams or developers where the tooling supports it. [2][3]

Risks, Costs and Security

Prioritize upgrades to the patched Pydantic AI versions, then review historical embedding traces and rotate credentials if secrets were exported. The release notes also identify earlier MCP credential leakage; affected deployments should assess exposure and rotate relevant credentials. [1][2]

Sandboxes, durable state, approvals, and telemetry add infrastructure cost and operational complexity. They are justified when agents access sensitive data or take consequential actions; for a narrow read-only workflow, a simpler, tightly constrained implementation may be safer and cheaper.

Sources

1. [1] v1.107.10 (2026-11-04)
2. [2] v2.66.0 (2026-11-04)
3. [3] v2.1.318