november 2026 · 4 min

Your Scanner Can't Read a README

AutoGen's README now opens with "Project archived and no longer maintained", and says "Microsoft is not providing bug fixes, security fixes, new features, or support for this project." Every signal your tooling reads still says the project is fine. GitHub doesn't show the repository as archived, and the PyPI packages carry the default status of "active". End of life was announced in prose, and dependency tooling doesn't read prose.

What Happened

AutoGen is Microsoft's multi-agent framework, around 60,000 stars. The notice went into the README on October 16, in PR #8366 ("docs: clarify AutoGen is archived and no longer maintained"). It points to Microsoft Agent Framework as the successor and still advises against production use. On November 6, John Langford, of the Microsoft research lab whose agent work included AutoGen, wrote that AI Frontiers is over (write-up here). By then the notice had been in the README for three weeks.

Here's the part the notice doesn't say. The last release of the core packages was 0.7.5, on September 30, 2025. Two hardening fixes landed on main after it:

$ git log --oneline python-v0.7.5..main | grep -E 'harden|trusted'
8544314 fix: restrict importlib provider loading to trusted namespaces (#7463)
b047730 fix: Improve AutoGen Studio: deprecate FunctionTool, harden MCP WebSocket endpoint (#7362)

The first one limits which Python modules a component config is allowed to import. Install autogen-core from PyPI and you get 0.7.5, which has no such limit: the trusted-namespace list exists only in the repo. The fix exists, and it never shipped. Microsoft says it isn't providing security fixes, so a 0.7.6 isn't coming.

b047730 belongs to AutoGen Studio, a separate package: it's the hardening behind the AutoGen Studio code-execution issue Microsoft disclosed in June. That one, per the disclosure, affected builds from main, not the released package. The point isn't that either is an open hole in your install. It's that this is a framework whose job is to run agents that call tools and execute code, its maintainers were still finding things to harden this spring, and the people who would ship the next fix have said they won't.

And the machine-readable side:

The Check

Python packaging has a field for this. Project status markers (active, archived, quarantined, deprecated) are served by PyPI's Simple API. Nobody set one here. So read both: the marker, and the age of the latest release.

import json, sys, urllib.request
from datetime import datetime, timezone

def get(url, accept=None):
    req = urllib.request.Request(url, headers={"Accept": accept} if accept else {})
    with urllib.request.urlopen(req) as r:
        return json.load(r)

now = datetime.now(timezone.utc)
for name in sys.argv[1:]:
    meta = get(f"https://pypi.org/pypi/{name}/json")
    uploaded = max(f["upload_time_iso_8601"] for f in meta["urls"])
    age = (now - datetime.fromisoformat(uploaded.replace("Z", "+00:00"))).days
    simple = get(f"https://pypi.org/simple/{name}/",
                 "application/vnd.pypi.simple.v1+json")
    status = simple.get("project-status", {}).get("status", "active")
    print(f"{name:24} {meta['info']['version']:10} {age:5}d  {status}")

$ python3 stale.py autogen-agentchat autogen-core autogen-ext
autogen-agentchat        0.7.5        405d  active
autogen-core             0.7.5        405d  active
autogen-ext              0.7.5        405d  active

The marker says active. The age says over a year. When the two disagree, believe the age, then go read the README.

Own the Decision

My take on supply chain failures: what's missing is rarely a tool, it's agency. The README notice had been there for three weeks before the lab news, and the unreleased fixes for months. No scanner was going to raise either, because the flag a scanner reads was never flipped.

So make it someone's job:

The Tradeoff

Release age is a blunt instrument. A small library that's simply done looks exactly like an abandoned one, and a year-old release is normal for plenty of good code. Expect false positives, and expect to keep an allowlist of finished packages you've decided to trust as they are.

That's fine. The alternative is waiting for a flag that the maintainer, by definition, is no longer around to flip.

← all posts