The Agentic Stack Hits Production — And Reveals Its Blast Radius

Microsoft's Agent Framework hits 1.0, MCP spreads across Azure and Databricks, and xAI ships voice agents. But the practitioners running these systems in production are warning the risks are now yours.

The agentic AI stack is no longer a research demo. On April 3, 2026, Microsoft released Agent Framework 1.0 as a production-ready, open-source framework for .NET and Python. Meanwhile, the people running these agents in production are warning that "production-ready" doesn't mean "safe" — it means the risks are now yours.

The plumbing is shipping

Three threads converge this week. Microsoft's Agent Framework 1.0 GA gives a unified path for multi-agent workflows on Azure. The Model Context Protocol — the connective tissue between agents and tools — is showing up across the major clouds: Azure Foundry now connects agents to MCP servers, and Databricks added MCP to its AI Gateway so workspace LLMs can dynamically discover and call tools. On the consumer side, xAI announced grok-voice-think-fast-1.0, pushing voice agents toward lower latency.

The framework conversation is also coalescing. A Moon Technolabs survey from this week points to LangGraph, CrewAI, and AutoGen as front-runners, but cautions that each solves a different scale problem. Codex, OpenAI's GPT-5.5-powered agentic coding tool, reportedly serves 4M developers weekly as of April 2026. Agentic coding is no longer niche.

The blast radius problem

Simon Willison spent the week posting reminders that the practical concerns haven't gone away. "AI agents make mistakes all the time," he wrote — "you have to assume they will, and then design their environment so that when they do they can't delete your production database." Running a coding agent for hours unattended? The trick is a sandbox where mistakes don't matter. And if an agent does six hours of damage, good backups let you roll back both code and data.

This is the unglamorous flip side of general availability. Agents aren't humans, and the mistakes they make can be surprising in ways human reviewers don't anticipate.

What this means

For builders, framework choice matters less than your isolation story. A capable agent without a sandbox is a liability you don't know you have yet. For buyers, ask vendors how their agents fail — and what blast radius they assume when something goes wrong. For everyone, the plumbing is now mature enough that the next round of incidents will come from the boring stuff: permissions, secrets, and recovery procedures.

The bottom line: Treat every agent deployment as a question of containment first and capability second — the difference is whether your worst day is recoverable.

Sources