Microsoft Agent Framework

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Code execution 40 % Injection 25 % Access control 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Agent Framework is Microsoft's consolidated successor to Semantic Kernel and AutoGen, and the supported path for building agentic applications on Azure AI Foundry in .NET and Python. At over twelve thousand stars less than a year after launch it is on a steep adoption curve, but its position matters more than its current install base: this is the code that decides which tool calls actually execute, what an agent is permitted to touch, and how agent state is persisted and rehydrated between runs. That makes it the security boundary for a class of application currently being deployed faster than it is being reviewed, and Microsoft has clearly already had to reason about it, since the program carries a named pickle-deserialization carve-out. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program, where a high-quality Critical report in the deserialization or code-injection class tops out at $15,000, and sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of microsoft/agent-framework , which the program names on its SCOPE list, at Critical or Important severity on the most recent actively maintained branch, with local-machine-only impact payable because Microsoft names this project in the carve-out The agent and workflow runtime in both the .NET and Python implementations: how a run is scheduled, how state moves between steps, and what each agent in a graph is permitted to reach The tool and function-calling boundary, including how model-supplied arguments are validated before the framework acts on them The Model Context Protocol client and server integration surface Checkpoint serialisation and state rehydration, and the storage adapters behind them, subject to the pickle carve-out Model connector, chat client and credential handling across every provider the framework ships The memory, thread and context stores, and the middleware layer applications hook into The published packages and the GitHub Actions workflows that release them, which the program prices in a band of their own Out of scope Pickle deserialization that presupposes the attacker already has write access to the checkpoint storage backend, which Microsoft treats as a trusted channel in the deployment architecture DevUI and other prototype, experimental or local-testing-only components microsoft/semantic-kernel and microsoft/autogen , which the program's own scope text names as separate projects it does not include Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing Model output quality, hallucination, and prompt injection treated as jailbreak where no security boundary is actually crossed Moderate and Low severity, which pay $0 at every report quality Samples, tutorials, quickstart code and samples/ directories Dependency-confusion reports Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Checkpoint deserialization that rehydrates attacker-influenced state into code execution without assuming write access to the checkpoint store: deserialization of untrusted data is the $15,000 top band, and the carve-out only removes the trivial version of it A tool or function-calling boundary flaw where model-supplied arguments reach a shell, a filesystem path or an evaluation primitive without the validation the framework promises A hostile MCP server escaping the permissions the agent granted it, reaching tools, credentials or host state it was never authorised for Model connector or credential handling that leaks API keys or Azure tokens into logs, traces, or the model context itself A workflow engine authorization flaw that lets one agent in a multi-agent graph invoke a tool or read state belonging to another Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Pickle deserialization reports that presuppose the attacker already has write access to the checkpoint storage backend are excluded, so a qualifying report has to reach the deserializer without that assumption DevUI and other prototype, experimental or local-testing-only components are out of scope microsoft/semantic-kernel and microsoft/autogen are separate projects and are not funded by this program Only Critical and Important severity qualify; Moderate and Low findings pay $0, and local-machine-only impact is payable because Agent Framework is named in the carve-out Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC, which holds the detail until fixed packages ship and then publishes its own advisory with researcher credit. The scope on this project is still moving, it was clarified on the program page in June 2026, so confirm the current boundary before you invest time. Because the program's confidentiality terms read directly on third-party disclosure, file with MSRC yourself first and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability