AutoGen: conversational multi-agent

At 3:07 a.m., Northstar Books needs its monthly revenue report. The request sounds small: reconcile 12,480 orders, explain three suspicious refunds, run the tests, and email the finished report to finance.

A single model can write SQL and confidently misread a refund as a sale. A fixed pipeline can prevent that, but it must know the sequence in advance. Northstar’s useful version has an analyst inspect the data, an executor run code, a reviewer challenge the result, and a tester check the report.

The problem is coordination: who speaks next, what result do they see, and when is the work finished? If agents decide what to say and do by passing messages, you have the problem AutoGen was built to model.

AutoGen is Microsoft’s framework for conversational multi-agent systems. Define agents that send and receive messages, then let the conversation carry the work forward. LangGraph makes the graph explicit; CrewAI makes roles and tasks explicit. AutoGen puts the transcript at the centre. That flexibility is useful only when the next action really depends on what another agent discovers.

ConversableAgents that message each other

An agent receives context, decides on a response or action, and sends a message. In AutoGen, the base idea is a ConversableAgent.

The classic two-agent arrangement has two contrasting parts:

• AssistantAgent is the LLM-backed reasoner. It interprets requests, writes answers, proposes code, or asks another agent to act.
• UserProxyAgent represents a user or executing partner. In the older pattern, it can run generated code, call tools, and pause for human input.

The assistant proposes an action; the other agent performs it and returns an observation. That observation becomes new context, allowing the assistant to correct itself. For Northstar, it might write a query, receive suspicious rows, request a join against the original orders, then produce the report.

Here is the mechanism without framework plumbing:

# AutoGen-style two-agent loop: an Assistant writes code, a UserProxy executes it.
def assistant(turn):
    return "print(sum(range(1, 11)))" if turn == 1 else "TERMINATE"

def user_proxy(code):
    return "55" if "sum(range(1, 11))" in code else ""

turn = 1
while True:
    msg = assistant(turn)
    print(f"Assistant -> {msg}")
    if msg == "TERMINATE":
        print("conversation ends")
        break
    print(f"UserProxy (exec) -> {user_proxy(msg)}")
    turn += 1

Assistant -> print(sum(range(1, 11)))
UserProxy (exec) -> 55
Assistant -> TERMINATE
conversation ends

This teaching model omits model clients, message objects, executor configuration, permissions, and error handling. It shows the causal loop:

propose, execute, observe, revise, terminate.

A termination condition says when the conversation should stop. The old pattern often used a text sentinel such as TERMINATE. Production systems should also check observable facts: the report exists, required fields are present, tests passed, and approval was recorded. A word in an LLM response is not proof of completion.

The historical AssistantAgent plus UserProxyAgent idiom also combines responsibilities that AutoGen 0.4 separates. A user-facing agent can collect input, an executor can run code, and an assistant can use tools. Treat these as distinct capabilities so their permissions are clear.

What a conversation actually does

“Let them talk” hides four runtime decisions:

1. Store a transcript. Messages record sender, role, and content, which might be text, a tool call, code, an error, or an artifact reference.
2. Choose a speaker. A two-agent loop has a fixed next speaker. Legacy 0.2 GroupChatManager selected one; 0.4 teams use a team policy or graph.
3. Act. An LLM may call a model, a tool agent may query a database, and an executor may run a process.
4. Append the result and check termination. Errors can trigger repair; valid artifacts can trigger review.

The transcript is a control surface, not a shared mind. Agents know only the context the runtime delivers. Pass a file or trusted artifact reference when a reviewer needs a CSV; do not assume that mentioning /tmp gives another agent safe access.

Legacy AutoGen 0.2 API: GroupChat

The names here are the legacy AutoGen 0.2-style API. GroupChat held the shared conversation, while GroupChatManager selected a member and broadcast its message. These are not the current AutoGen 0.4 AgentChat team abstractions.

The current 0.4 choices divide that responsibility:

• RoundRobinGroupChat uses a fixed order.
• SelectorGroupChat uses a selector policy, commonly an LLM, to choose the next agent.
• Swarm uses explicit handoffs between agents.
• GraphFlow represents directed dependencies; documentation has treated it as experimental, so check its current status before production use.

Legacy 0.2 speaker selection could be round-robin, LLM-chosen, or custom—for example, allowing the reviewer to speak only after an executor artifact existed. In 0.4, choose the team type that matches the control need. A manager or selector chooses speakers; it does not prove that the speaker is qualified or that the previous artifact is valid.

Follow one task through the numbers

Suppose Northstar’s request is 200 input tokens. The first assistant turn produces 300 tokens of code and a plan. The executor returns 40 tokens of tool output. A reviewer produces 180 tokens, a second executor returns 80 tokens of test output, and the final assistant writes 120 tokens.

There are five context-bearing turns but only three model calls: the first assistant, reviewer, and final assistant. If each model call receives the full transcript, their input contexts might be 200, 540, and 800 tokens: 1,540 input tokens total. Model output is 300 + 180 + 120 = 600 tokens. The conversation contains 720 output tokens, but the executor supplied 120 of them; those observations can still increase later model input.

At r_in dollars per million input tokens and r_out per million output tokens, the model-token cost is:

0.00154 × r_in + 0.00060 × r_out

That excludes provider-specific caching and tool charges. Sequential model turns also add latency: at 1.2 seconds each, the model portion is 3.6 seconds, before queries, containers, network calls, and retries. Relevant-history filtering and artifact references reduce cost, but summarisation can remove evidence the reviewer needs.

The actor-model runtime in AutoGen 0.4 and later

AutoGen 0.4 introduced an asynchronous, event-driven actor model underneath the conversation APIs. An actor owns state and processes messages. Asynchronous execution lets other work proceed while an actor waits for a model or tool. Events trigger work rather than every component blocking on one central loop.

autogen-core provides messaging and actor foundations; autogen-agentchat provides higher-level agents and teams. Independent analyses can run concurrently, but dependent work cannot: a reviewer still waits for the analysts, and shared file writes need coordination.

This runtime also adds delayed messages, duplicate deliveries, unresponsive actors, and tasks that outlive their requests. Use timeouts, cancellation, correlation IDs, and explicit ownership of side effects.

Use AgentChat for a team quickly; use the core runtime for custom message types, routing, or distributed behaviour. Neither layer designs termination policy for you.

A production pattern that does not drift into chatter

Define a contract before inventing agent personas:

• The analyst reads order and refund tables but cannot email.
• The executor runs read-only queries in a disposable environment.
• The reviewer names disputed rows and calculations.
• The tester returns machine-readable pass or fail.
• The writer creates a report only after review and tests pass.

Keep business state—artifacts, query hashes, approvals, and test results—outside the transcript. Pass stable references between agents. Bound every conversation with a turn limit, deadline, and retry limit. Terminate on validated success or explicit failure; TERMINATE is only a convenience signal.

Separate side effects by risk. Require approval before email, use an idempotency key to prevent duplicate sends, and record authorization. Give executors minimum filesystem and network access, capped resources, no ambient credentials, and validated tool arguments. A sandbox reduces damage but does not solve prompt injection or credential theft. See reliability for agents, Agent Security, and credential-blind execution.

Log agent names, model requests, selected speakers, tool arguments and results, durations, tokens, retries, termination reasons, and redacted secrets. Without that trace, a wrong 3 a.m. report is difficult to diagnose.

Failure modes you will see first

• Never-ending conversation: require structured success, cap review cycles, and combine semantic stopping with mechanical limits.
• Growing bill and weaker answers: summarise completed stages, keep source data outside chat, and preserve identifiers and hashes for verification.
• Overpowered executor: remove credentials, restrict network and filesystem access, cap resources, and approve writes.
• Wrong speaker: use deterministic selectors at stage boundaries. Let LLM selection operate only where several agents are genuinely interchangeable.
• Shared wrong answer: require recalculation, independent queries, invariant checks, or a different data path. More messages do not create independent truth.

When to reach for AutoGen

Use AutoGen when the conversation is the mechanism: an executor’s error changes the next query, a reviewer challenges an artifact, or a specialist takes over based on evidence. Use a graph or ordinary code when “conversation” merely disguises a fixed sequence.

In one breath

• AutoGen coordinates agents through messages and a shared conversation.
• The classic loop is AssistantAgent proposing work and UserProxyAgent or an explicit executor returning observations.
• Legacy 0.2 used GroupChat and GroupChatManager; 0.4 AgentChat instead offers RoundRobinGroupChat, SelectorGroupChat, Swarm, and GraphFlow.
• AutoGen 0.4 adds an asynchronous actor runtime beneath AgentChat.
• As of August 2026, Microsoft AutoGen is in maintenance mode; new Microsoft-backed projects should consider Microsoft Agent Framework. AG2 is independent.
• Conversation costs tokens, latency, context management, and predictability. Use it when adaptive dialogue is genuinely the work.

Quick check

Next

Compare CrewAI for roles and tasks, LangGraph for explicit graphs, and multi-agent orchestration for framework-agnostic patterns.