Your best framework might be no framework at all

Among senior engineers building high-stakes systems, the most quietly influential pattern of 2026 is the rejection of orchestration libraries altogether. This is not a contrarian aesthetic. It is a response to two years of debugging other people's abstractions.

The thesis, codified in the "12-FactorAgents" architecture that gained traction through 2025 and remained the dominant philosophy into 2026, treats an agent as ordinary software with LLM calls embedded at well-chosen deterministic junctures. Persistence is a SQLite or Postgres table. Retries are a decorator. Tool calls are HTTP endpoints. The agentic part is restricted to specific reasoning steps, and the engineer owns every line in between.

The tradeoff is honest. You write your own checkpointing, your own context-window management, your own multi-turn tool loop, and your own retry semantics. For a team racing to an MVP this is fatal. For a team that has already shipped one agent and spent a quarter debugging it, the math reverses.

The lesson is not that frameworks are bad. It is that the cost of an abstraction only becomes visible after the demo, and several teams have decided the demo wasn't worth it.

The state machine has replaced the role-play

The early multi-agent frameworks asked the LLM to decide when to hand off, which specialist to invoke, and how to combine results. By 2026 this pattern is largely discredited in production. The dominant architecture is now the explicit graph: the engineer defines the nodes and edges, and the LLM is restricted to reasoning at the leaves.

LangGraph has become the default expression of this idea, with roughly 32k stars and a verified production roster that includes Klarna, Uber, LinkedIn, BlackRock, Cisco, and JPMorgan. Its value is real. Native checkpointing lets a workflow pause for human approval on a financial tool call and resume days later. Time-travel debugging lets engineers replay any node with a different prompt or model during a postmortem. For regulated workloads where every transition needs an audit trail, the alternative is building this scaffolding yourself, badly.

The friction is also real, and not addressed by version 1.0. The most-cited practitioner critique remains a 2025 Hacker News comment that still circulates:

Issue traffic from early 2026 reinforces the point. A May 2026 issue reported checkpoint serialisation causing 85% storage overhead. A February 2026 issue described non-serialisable objects breaking checkpointers in production. The default MemorySaver is RAM-only and will not survive a container restart, which catches teams that read the tutorial and not the deployment guide.

Then there are the CVEs. In March 2026, Cyera disclosed three vulnerabilities across the LangChain dependency tree, including CVE-2025-68664 (deserialization, CVSS 9.3) and CVE-2025-67644 (SQL injection in the LangGraph SQLite checkpointer). All patched, but the disclosure reframed the framework from something to be trusted to something to be audited. This is the correct posture for any agent framework now, but LangGraph paid for the lesson on behalf of the field.

Type safety is doing more work than role definitions ever did

PydanticAI has climbed to around 17k stars by offering something narrower than its competitors: validated structural contracts on LLM output, tight observability through Logfire, and almost nothing else. The framework is stateless by default. There are no native multi-agent handoffs, no built-in durable execution. You bring your own orchestration.

This is a feature. A 90-day production benchmark by Nextbuild in early 2026 found that a PydanticAI deployment cost $390 over the window compared to over $1,000 for heavier alternatives, and caught 23 data-integrity bugs that other frameworks silently passed through. Built-in usage limits cap request tokens, response tokens, and tool calls at the agent definition, which closes the most common silent-cost-overrun in production agents.

A pattern is emerging where teams use LangGraph or the Microsoft Agent Framework for the outer orchestration and PydanticAI inside each node. The graph gives you durable execution. The validation gives you schema enforcement at every LLM boundary. The framework choice is no longer one decision; it is a layered stack, and the type-safety layer is the part that quietly prevents the most outages.

Multi-agent role-play is the cosmetic feature most worth questioning

CrewAI hit roughly 51k stars on the strength of an intuitive mental model. You declare agents with roles, goals, and backstories, assemble them into a Crew, and watch them collaborate. For a stakeholder demo this is unmatched. For production it is where most of the 2026 horror stories live.

The structural problems are well documented. Issue #3154 describes agents producing valid-looking Thought-Action-Observation traces without ever calling the tool, fabricating the observation and continuing to the final answer. This reproduces across GPT-4 and Qwen, so it is not strictly a framework bug, but the framework also does not catch it. Issue #3202 documents a dependency conflict where chromadb forces an onnxruntime version that does not exist on macOS, silently downgrading installs. Token inflation from role-based prompts runs 30 to 50% above a hand-tuned LangGraph equivalent. Benchmark runs of complex executions have been reported in the $400 range for what would cost a fraction of that elsewhere.

None of this means CrewAI is unusable. It means the role-play metaphor is a UI feature, not an architecture, and it should be treated as such. Use it for internal content workflows where token cost is not the constraint. Do not use it for the customer-facing path.

The OpenClaw disaster is the most vivid lesson, but not the only one

In May 2026, cybersecurity researchers disclosed the "Claw Chain", a set of vulnerabilities (CVE-2026-44112 through 44118) in OpenClaw, a local-first agent runtime that had achieved viral adoption on the promise of privacy and simplicity. The flaws included TOCTOU race conditions in the sandbox and an authentication bypass that allowed non-owner clients to impersonate the system owner via spoofed bearer tokens. Chained through prompt injection, the result was one-click remote code execution. Over 42,000 instances were exposed to the public internet at the time of disclosure.

The framing matters. OpenClaw's mistake was not local-first execution, which is a legitimate architectural choice for sensitive data. It was treating configuration ergonomics — the convenient SOUL.md and SKILL.md files — as a substitute for foundational security hygiene. The same lesson applies more broadly. Smolagents allows the model to write and execute Python directly, and the project itself warns that its LocalPythonExecutor is not a security boundary. The framework gives you a powerful primitive. It does not give you safety by default.

That distinction is now load-bearing for any agent that executes code, and the industry standard is hard sandboxing through E2B, Modal, or Docker isolation. The LangChain CVEs from March 2026 are the same story in a less dramatic form. A framework with 137k stars and many millions of weekly downloads is an attack surface, and "popular" is not "audited".

What's quietly happening underneath

While the framework debates dominate the surface, the more durable change is happening at the protocol layer. Three standards have effectively won.

The consolidation at the protocol layer means framework choice increasingly determines operational philosophy rather than capability. Whether you orchestrate with LangGraph or the Microsoft Agent Framework, your tools, traces, and inter-agent messages travel the same rails.

Two of the most influential frameworks of the 2024 hype cycle are now legacy. Microsoft formally moved AutoGen to maintenance mode in early 2026 and routes new users to the Microsoft Agent Framework, which reached general availability in April 2026. Semantic Kernel has been absorbed into the same lineage. IBM donated the Bee Agent Framework to the Linux Foundation and explicitly disclaimed maintenance. LangChain itself remains a vast integration ecosystem, but practitioner sentiment on the base library has turned sharply — recent threads describe it as bloated and over-abstracted. The honest framing: LangChain is overrated as a runtime and underrated as glue. Use the connectors. Orchestrate elsewhere.