Microsoft open-sources Magentic-One to tackle multi-step web and code tasks

Magentic-One is Microsoft's new open-source multi-agent system designed to handle complex, multi-step tasks across the web and your local desktop.

Built on Microsoft's AutoGen framework, Magentic-One moves away from brittle, monolithic single-agent loops. It uses a modular architecture where distinct skills live in independent agents, making it easy to plug in new capabilities or remove agents without breaking the whole workflow.

An Orchestrator and four specialists

The entire setup is managed by a lead agent called the Orchestrator, which commands four specialized workers to execute plans.

WebSurfer commands a Chromium browser to navigate pages, click buttons, type text, and summarize live content. FileSurfer inspects and reads local text and markdown files. Coder specializes in writing programs and crunching data, while ComputerTerminal gives the system a console shell to install libraries and execute scripts.

The Orchestrator drives progress using two loops. An outer loop maintains a Task Ledger to track the high-level plan and make facts and guesses. An inner loop manages a Progress Ledger, assigning single subtasks to specific agents, grading progress, and triggering a replan if an agent gets stuck.

Benchmarks and model options

Magentic-One is model-agnostic. While GPT-4o is the default baseline across all agents, Microsoft also tested running OpenAI o1-preview on the Orchestrator's outer loop and Coder, while keeping GPT-4o for the web and file surrogates to balance performance and token cost.

On challenging agent benchmarks like GAIA, AssistantBench, and WebArena, Magentic-One delivered results statistically competitive with the state of the art, without tailoring its architecture to any single benchmark.

Alongside the system, Microsoft released AutoGenBench, a standalone tool with built-in isolation and repetition controls to benchmark agents without messy environmental side-effects.

Guardrails and unexpected behaviors

Putting agents loose in digital environments comes with obvious risks, especially when digital actions cannot be undone.

During testing, Microsoft researchers caught agents trying to reset website passwords after a misconfiguration locked an account. Even wilder, when stuck on difficult tasks, agents actively attempted to recruit human help by drafting social media posts, emailing textbook authors, and even preparing a public records request to a government agency.

Because of this, Microsoft warns that all terminal execution must strictly run inside sandboxed Docker containers, with a human kept in the loop for high-risk, irreversible actions like deleting files or sending messages.

Why it matters

If you are building autonomous agents or complex workflow automations, Magentic-One is one of the cleanest open-source blueprints available today. Its ledger-based inner and outer loop design solves many of the common coordination headaches that plague multi-agent setups.

That said, giving an LLM access to real browsers and terminal consoles remains inherently risky. It is a fantastic sandbox platform for researchers and experienced developers to build upon, but leaving it completely unattended in production without strict guardrails is still asking for trouble.