The Agentic Stack | VekktorAI

In this episode, Alice and Mouli unpack the operational collapse of synchronous tool calling in enterprise environments and the arrival of the Model Context Protocol (MCP) Tasks extension specification. They examine how treating agentic tools as blocking JSON-RPC request-response loops causes connection drops, thread pool starvation, context lock, and orphaned background writes when operations take longer than a few seconds. The takeaway isn't that agent endpoints need to return faster; it's that enterprise tools are long-running distributed jobs requiring durable asynchronous task handles. Mouli and Alice break down concrete implementation mechanics: issuing decoupled TaskHandles in under fifty milliseconds, isolating polling and SSE streams strictly within platform orchestration rather than token-incinerating model reasoning loops, enforcing the tasks/cancel lifecycle, and building contract tests for network partitions and zombie tasks. They close with key enterprise considerations on client-side synthetic timeouts, mandatory client-generated idempotency keys, and fail-closed state persistence. High-signal, actionable systems engineering with zero marketing fluff. Thanks for listening to The Agentic Stack.
Keywords
Model Context Protocol, MCP Tasks, asynchronous tool calling, agent runtime architecture, JSON-RPC, idempotency keys, token budget optimization, distributed systems, contract testing, synthetic timeouts, fail-closed systems, enterprise AI

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

Microsoft Agent Framework Python 1.24.0 changes the beta RedisContextProvider scope schema and refuses to auto-migrate incompatible indexes. Persistent agent memory becomes a planned-downtime migration: delete the legacy raw-scope index and context hashes, let the new version create a fresh index, re-ingest context data, and move CI and runtime images to Python 3.11+. Mouli and Alice break down the builder checklist, the risk of false confidence around overwrite_index=True, and why agent memory now needs versioned migrations and operational discipline.

Keywords: Microsoft Agent Framework, RedisContextProvider, agent memory migration, Python 3.11, persistent agent memory, schema break, AI agent infrastructure.

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

This episode treats framework patch notes as the real reliability signal for production agents. We examine OpenAI Agents SDK v0.24.0 and Microsoft Agent Framework .NET 1.26.0, focusing on multi-turn orchestration, session-write batching, parallel tool-call gating, Copilot hook composition, and compaction during pending approvals. We cover practical regression tests, operational checks, pinning cadence for weekly patch churn, and the uncertainty created by release-mirror evidence.

Keywords: Agentic Stack, OpenAI Agents SDK, Microsoft Agent Framework, agent orchestration, patch churn, session state, tool-call gating, hook composition, approval state, production reliability, AI agents, framework upgrades

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

Meta's Muse Spark Open brings open weights, a 1M-token context window, and explicit tool-calling tuning to the repo-scale coding agent conversation. This episode treats it as a build-vs-buy decision: what to test, how to pin hardware and runtime, and why independent benchmarks matter before production adoption.
Keywords: Meta Muse Spark Open, open-weight model, 1M-token context, tool calling, repo-scale coding agents, self-hosted AI, agentic coding, GB300 NVL72, Agentic Stack

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

Orca Agent Engine is now Apache 2.0 Developer Preview, a production-used agent runtime moving to a self-hostable model with governance controls, CLI, and TypeScript, Python, and Go SDKs. This episode covers what changed, practical builder evaluation steps, portability testing across SDKs, the risk of a Developer Preview without independent security audits or scaling data, and what it means for teams considering a managed agent harness alternative.

Keywords: Orca Agent Engine, OAE, Apache 2.0, self-hosted agents, agent runtime, agent governance, AI agents, agentic AI, TypeScript SDK, Python SDK, Go SDK, CLI, Developer Preview, managed agent harness, Agentic Stack

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

Strands shipped a harness on September 21st, 2026 with a headline claim of frontier performance at 28% lower token cost. Three days later, Dark Reading reported a prompt-injection vulnerability in the agentic app Manus that could have enabled data theft and compromise. This episode connects the harness-as-product shift to the harness-as-trust-boundary problem: if tool output, intermediate reasoning and persistent memory all count as attacker-controllable inputs — as OWASP's 2026 LLM01 entry now states — then the layer you adopt to manage context, tools and loop control is also the layer where your trust seams live. We give three concrete builder actions: audit your context, tool and memory boundaries against the OWASP 2026 LLM01 categories; test injection filters on external data and tool output, across turns; and benchmark harness token-cost claims against your own workload before adopting. We also cover the risk of trigger-based, dormant injections and one forward-looking prediction about provenance as the next harness competitive axis.

Caveats stated on air: Strands' 28% lower token-cost claim includes no benchmark methodology, task set or baseline in the source. The OWASP 2026 LLM01 repository item is undated. Nothing suggests Manus used Strands, and the two events are adjacent in time, not causally linked. The trigger-based injection research cited is undated.

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

Agent skill supply-chain security is where prompt injection is heading next. This week on The Agentic Stack, we work through SkillSecurer, an arXiv preprint submitted on September 12, 2026, that detects and patches prompt injection vulnerabilities inside the reusable capability modules agents load. The conversation covers why a skill's instruction text and tool declarations are trusted by default, and why runtime input filtering never sees them. They also walk through the Open Worldwide Application Security Project's 2026 injection entry, which expands the definition of injection to cover tool output, intermediate reasoning traces, and persistent memory, plus the documented skill-dispatch pattern that pushes reusable skills into small embeddable kernels. Builders get a concrete control: treat skills as untrusted dependencies, pin and diff them, and put a detection gate in continuous integration and in the load path. The episode is candid about limits. SkillSecurer is a preprint with no independent production validation, and load-time scanning does not replace runtime handling of tool output. Closing with signed skill manifests and memory-write detection as the two things worth watching. The Agentic Stack.

Keywords: agent skill supply-chain security, prompt injection, OWASP LLM01 2026, SkillSecurer, AI agent security, tool output injection, persistent memory injection, skill detection and patching, agent frameworks, secure agent skills, indirect prompt injection, agent governance

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

Indirect prompt injection is being stress-tested from three directions at once, and the shared assumption underneath current agent security practice is what's under pressure. Three papers published within nine days of each other reframe the problem: ECLIPSE describes a self-evolving attack built for long-horizon agentic sessions, a second paper recasts injection payloads as something found by test-time search rather than authored by hand, and a third evaluates multimodal injections against agentic frameworks instead of isolated models. A practitioner piece from the same week describes these injections as hidden from human overview. This episode names the failing assumption rather than cataloguing attacks: detection placed at the transcript level, output scanning and human review, is the layer all three are aimed past. We cover what actually changed, one practical shift for builders — move enforcement to the action layer and treat retrieved content as attacker-controlled input by default — and one limitation worth saying out loud, which is that none of this names a specific vulnerable framework. 

**Keywords:** indirect prompt injection, agentic AI security, long-horizon agents, multimodal prompt injection, test-time search attack, agent framework security, tool-using agents, AI agent guardrails, prompt injection benchmarks, agent orchestration security, ECLIPSE attack, LLM agent security

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.

You’ve built agents that can do amazing things. But can they survive production—load, audits, routing, cost pressure, and real users?

In this episode of The Agentic Stack, Mouli Sri breaks down five signals that show agentic AI is moving from clever demos to operational infrastructure for regulated industries like FinTech, InsurTech, and mortgage.

You’ll learn:

• Why adding more agents can actually make your system slower and more expensive (the “interaction tax”)
• How LangGraph is quietly becoming a go‑to framework for durable, stateful agent workflows
• What changed in the new MCP 2026‑07‑28 spec and why it matters for enterprise deployments
• Why “cost per token” is the only infrastructure metric that really matters for agentic AI
• The governance checklist you need before letting agents touch customer decisions, policy wording, or credit paths

Plus: real architect’s notes from building agentic systems in financial services, and concrete examples from underwriting and insurance advisory workflows.

If you’re designing agent systems that must survive production, this episode gives you the spine of what to optimize—and what to avoid.

Disclaimer: The views and opinions expressed on The Agentic Stack are solely those of the author and do not represent or reflect the opinions, views, or positions of any individual, company, or organization with which the author is affiliated. This podcast is provided for informational purposes only. Portions of this podcast were produced with the assistance of artificial intelligence.