# Unsloth Studio & GLM-5.2: How to Run a 744B Local LLM (2026 Tutorial)

> *Local AI is no longer limited to 7B models on a laptop. In June 2026, Unsloth Studio lets you run GLM-5.2 — 744 billion parameters — on your own hardware.*

**Unsloth Studio** changes the game for **local AI**. Until now, running a frontier LLM locally meant juggling Ollama, llama.cpp, Hugging Face, and obscure config files. Unsloth packs it into an **open-source web UI**: model search, GGUF downloads, optimized inference, tool calling, and code execution — on Mac, Windows, and Linux.

Meanwhile, **GLM-5.2** from Z.ai ships with Unsloth **Dynamic GGUFs** day zero: **744B parameters**, **40B active** (MoE architecture), **1 million token context**. Per Unsloth documentation, it competes on several published benchmarks with Claude 4.8 Opus, GPT-5.5, and Gemini 3.1 Pro — always validate on *your* use case.

## Why host GLM-5.2 locally? (GDPR & API Costs)

For an agency or a B2B company, the question is not just technical, it's strategic. Running a frontier LLM like GLM-5.2 locally offers two massive business advantages:
1. **Total privacy (GDPR):** You can inject sensitive client data (contracts, HR databases, medical records) without ever sending a byte to OpenAI or Anthropic servers.
2. **Zero inference cost:** Hooked up to an autonomous n8n agent running 24/7, a classic API model would bill hundreds of dollars a month in tokens. Locally, the marginal cost is zero.

This tutorial walks you through Unsloth Studio, hardware sizing, installation, running GLM-5.2, Thinking modes, and bridging to **n8n** for production agents.

---

## Unsloth Studio: the web UI that simplifies local AI

Unsloth has been known since 2024 for faster **fine-tuning** (up to 2× speed, 70% less VRAM per their docs). In 2026, **Unsloth Studio** adds a consumption layer: a web UI for local inference, not just training.

### Unsloth Studio vs Ollama / LM Studio for massive models

Why not simply use Ollama or LM Studio?
Ollama is fantastic for smaller models (Gemma 4, Llama 8B). But for a 744B parameter behemoth like GLM-5.2, Unsloth Studio was specifically designed to optimize **Dynamic GGUFs** (where some layers are heavily compressed and others are not) and **automatic offloading** between GPU VRAM and system RAM. The Studio UI also natively integrates Python code execution, which is crucial for modern agentic LLMs.

![Unsloth Studio architecture](/images/blog/unsloth-studio-glm-5-2-ia-locale-2026/3-flowchart-architecture-studio-en.png "Unsloth Studio: web UI, GGUF download, llama.cpp inference with RAM/GPU offload and integrated tool calling")

**What Studio delivers** (Unsloth docs, June 2026):

- Search, download, and run **GGUF** and **safetensors** models
- Self-healing **tool calling** + built-in web search
- **Python** and **Bash** code execution in the UI
- Automatic inference parameter tuning (temperature, top-p…)
- Fast CPU + GPU inference via **llama.cpp**
- Multi-GPU detection and **automatic RAM offloading**
- `--secure` option: free **HTTPS** tunnel via Cloudflare

![Unsloth and GLM-5.2 timeline](/images/blog/unsloth-studio-glm-5-2-ia-locale-2026/4-timeline-unsloth-glm-en.png "From fine-tuning acceleration (2024) to Unsloth Studio and day-zero GLM-5.2 (2026)")

For teams staying on lighter models (Gemma 4, Llama), our [Gemma 4 + Ollama + n8n tutorial](/en/blog/tutorial-gemma-4-ollama-n8n-local-free-private-ai-agent) remains the most accessible entry. GLM-5.2 targets another segment: **high-end workstations and servers** with 256 GB+ memory.

---

## GLM-5.2: what to know before installing

GLM-5.2 is **Z.ai's** open model, tuned for **long-horizon coding**, **reasoning**, and **agentic tasks**. Unsloth publishes **Dynamic GGUFs**: some layers stay high precision, others compress aggressively — hence the size/quality trade-off.

### Hardware requirements (Unsloth documentation)

Total memory depends on quantization. Unsloth publishes:

| Quant | Total memory required |
|---|---|
| 1-bit (dynamic) | ~223 GB |
| 2-bit (dynamic) | ~245 GB |
| 3-bit | ~290–360 GB |
| 4-bit | ~372–475 GB |
| 5-bit | ~570 GB |
| 8-bit | ~810 GB |

The **UD-IQ2_M** quant (2-bit dynamic) uses **~239 GB on disk** and is presented as the best accessibility/accuracy compromise. It fits a **256 GB unified-memory Mac**, or **1× 24 GB GPU + 256 GB RAM** with MoE offloading.

![Memory required by GLM-5.2 quantization](/images/blog/unsloth-studio-glm-5-2-ia-locale-2026/5-column-memoire-quants-en.png "Total memory (RAM+VRAM) by GLM-5.2 quantization — Unsloth data, June 2026")

> **Practical rule:** keep comfortable headroom above the quant file size. A full disk or saturated RAM triggers swapping that kills latency.

### Dynamic quants: what 1-bit really means

Unsloth measures quality via **KL divergence** (KLD) between the quantized model and BF16 reference. Published results:

- **Dynamic 1-bit**: ~**76.2%** top-1 accuracy, **86% smaller**
- **Dynamic 2-bit**: ~**82%** top-1 accuracy, **84% smaller**
- **Dynamic 4-bit / 5-bit**: near lossless per Unsloth

The common trap: assuming "76%" means 24% wrong answers. Unsloth stresses this reflects **token distribution** (filler words, phrasing), not factual correctness. "The capital of France is Paris" stays Paris — it's "I will" vs "Here is" that shifts. For extreme out-of-distribution tasks, **dynamic 4-bit** is safer.

---

## Installing Unsloth Studio

![Unsloth Studio installation steps](/images/blog/unsloth-studio-glm-5-2-ia-locale-2026/1-flowchart-installation-en.png "Pipeline: install, launch Studio, download GLM-5.2, local inference")

### Step 1 — Install Unsloth

**macOS, Linux, WSL:**

```bash
curl -fsSL https://unsloth.ai/install.sh | sh
```

**Windows PowerShell:**

```powershell
irm https://unsloth.ai/install.ps1 | iex
```

### Step 2 — Launch Studio

```bash
unsloth studio -H 0.0.0.0 -p 8888
```

Open `http://127.0.0.1:8888` in your browser.

For **HTTPS** access (especially on team networks), Unsloth provides a built-in Cloudflare tunnel:

```bash
unsloth studio --secure
```

### Step 3 — First launch

On first start, Studio asks you to **create a password**. Important: you're exposing an inference server on your machine — don't leave it unauthenticated on a shared network.

### Step 4 — Download GLM-5.2

1. Go to the **Studio Chat** tab
2. Search for **GLM-5.2** in the search bar
3. Select your quant (recommended: **UD-IQ2_M** if you have ~256 GB memory)
4. Start the download — verify disk space first (hundreds of GB)

Studio auto-detects **multi-GPU** setups and handles **RAM offloading**.

---

## Inference settings and Thinking modes

GLM-5.2 offers **three reasoning modes**:

- **No thinking** — direct answers, faster
- **High Thinking** — moderate reasoning
- **Max Thinking** — complex tasks (code, planning, agents)

![Thinking mode decision tree](/images/blog/unsloth-studio-glm-5-2-ia-locale-2026/2-flowchart-thinking-modes-en.png "Choose Max, High, or disable thinking based on task complexity")

### Recommended settings (Unsloth docs)

| Parameter | General tasks | SWE-Bench Pro |
|---|---|---|
| `temperature` | 1.0 | 1.0 |
| `top_p` | 0.95 | 1.0 |
| Max context | 1,048,576 tokens | same |

In Unsloth Studio, these are **auto-set**. You can adjust manually, plus chat template and context length.

### Disable or adjust thinking (llama.cpp)

GLM-5.2 reasons **by default**. To disable via CLI:

```bash
--chat-template-kwargs '{"enable_thinking":false}'
```

On PowerShell:

```powershell
--chat-template-kwargs "{\"enable_thinking\":false}"
```

For reasoning effort:

```bash
--chat-template-kwargs '{"reasoning_effort":"max"}'
--chat-template-kwargs '{"reasoning_effort":"high"}'
```

Recent llama.cpp versions also support `--reasoning on` / `--reasoning off`.

---

## CLI alternative: run GLM-5.2 with llama.cpp

If you prefer CLI over Studio, Unsloth hosts GGUFs on Hugging Face (`unsloth/GLM-5.2-GGUF`).

**Manual download (faster than integrated pull):**

```bash
pip install huggingface_hub
hf download unsloth/GLM-5.2-GGUF \
    --local-dir unsloth/GLM-5.2-GGUF \
    --include "*UD-IQ2_M*"
```

**Conversational inference:**

```bash
./llama.cpp/llama-cli \
    --model unsloth/GLM-5.2-GGUF/UD-IQ2_M/GLM-5.2-UD-IQ2_M-00001-of-00006.gguf \
    --temp 1.0 \
    --top-p 0.95 \
    --min-p 0.01
```

Unsloth demos a working Flappy Bird game with audio — even on **1-bit quant**. Impressive for demos; for business production, stick to **2-bit or 4-bit** for more headroom.

### Long context: quantize the KV cache

To use the 1M window without saturating RAM, llama.cpp lets you quantize the **KV cache**:

```bash
./llama.cpp/llama-cli \
    --model unsloth/GLM-5.2-GGUF/UD-IQ2_M/GLM-5.2-UD-IQ2_M-00001-of-00006.gguf \
    --temp 1.0 --top-p 0.95 --min-p 0.01 \
    --cache-type-k q4_1 \
    --cache-type-v q4_1
```

With `q4_1` (~5 bits/weight), Unsloth estimates roughly **3.2×** longer context vs default `f16`. A model capped at 10K tokens might reach ~32K — actual gains depend on your hardware.

---

## Benchmarks: read the numbers carefully

Unsloth publishes a comparison table: GLM-5.2 vs Claude 4.8 Opus, GPT-5.5, Gemini 3.1 Pro. Sample scores (source: Unsloth docs, June 2026):

| Benchmark | GLM-5.2 | Claude 4.8 Opus | GPT-5.5 |
|---|---|---|---|
| SWE-bench Pro | 62.1 | 69.2 | 58.6 |
| Terminal Bench 2.1 | 81.0 | 85.0 | 84.0 |
| AIME 2026 | 99.2 | 95.7 | 98.3 |
| MCP-Atlas | 76.8 | 77.8 | 75.3 |

**Honest reading:** GLM-5.2 is competitive — sometimes ahead of GPT-5.5 on agentic coding, sometimes behind Claude on SWE-bench Pro. These scores don't replace **testing on your own data**. For the broader open vs closed model landscape, see [DeepSeek V4 vs GPT-5.5](/en/blog/deepseek-v4-vs-gpt-5-5-open-vs-closed-ai-war-2026).

---

## Connect local GLM-5.2 to n8n workflows

Unsloth Studio and llama.cpp don't replace an orchestrator. For production agents, the winning stack remains:

1. **Local GLM-5.2** (Unsloth Studio or `llama-server`) for sovereign reasoning
2. **n8n** for triggers, retries, CRM/email integrations, and monitoring
3. **MCP** to expose business tools in a standardized way

Same approach as Ollama + n8n, with much heavier hardware requirements. Expose `llama-server` as an OpenAI-compatible API, then point n8n's **AI Agent** node to `http://localhost:8080/v1` (adjust port).

Further reading:

- [Connect n8n to an MCP server](/en/blog/connect-n8n-mcp-server-ai-agents)
- [12 AI agent frameworks in 2026](/en/blog/12-most-powerful-ai-agent-frameworks-2026)
- [MCP stabilized + A2A protocol](/en/blog/mcp-stable-a2a-protocol-ai-agent-interoperability-april-2026)

---

## Limits and when to stay on cloud

Local GLM-5.2 isn't for everyone:

- **Hardware cost**: a 256 GB+ machine costs thousands of euros
- **Power and noise**: 24/7 inference on a large MoE consumes energy
- **Updates**: you manage new model versions yourself
- **First-token latency**: even optimized, a 744B MoE stays slower than a cloud API

**Stay on cloud** (Claude, GPT, Gemini) with unpredictable load spikes, no ops team, or needs under 70B parameters. **Go local** if data sovereignty, flat-rate volume costs, or vendor independence matter — themes we cover in [the AI vendor resilience article](/en/blog/us-government-suspends-fable-5-anthropic).

---

## Conclusion

**Unsloth Studio** democratizes advanced local AI: you no longer need to be a llama.cpp expert to run a frontier model. **GLM-5.2** pushes the open-source ceiling toward code and agentic capabilities that rival premium APIs — provided you have the **right hardware** and understand dynamic quant trade-offs.

**Quick checklist:**

1. Verify total memory (target: 256 GB+ for UD-IQ2_M)
2. Install Unsloth (`curl` or `irm` per OS)
3. Run `unsloth studio -p 8888` (or `--secure` on a network)
4. Download GLM-5.2 UD-IQ2_M from the Chat tab
5. Pick Thinking mode for your task
6. Wire n8n + MCP to industrialize

**BOVO Digital** helps companies with hardware sizing, Unsloth/Ollama deployment, n8n integration, and secure on-prem agent rollout. [Contact us](https://bovo-digital.tech/en/contact) for a local AI feasibility audit.

Install Unsloth Studio and run GLM-5.2 locally. Ideal for B2B (GDPR, zero API costs), comparison vs Ollama, Dynamic GGUF quants, and n8n bridge explained.

Unsloth Studio & GLM-5.2: Local 744B LLM Guide (2026)

Unsloth Studio & GLM-5.2: How to Run a 744B Local LLM (2026 Tutorial)

# 12 AI Agent Frameworks (2026): Python vs Low-Code Comparison

> *Connecting an LLM to an app is no longer enough. In 2026, the battle is fought on memory, orchestration, tools, and production reliability.*

**Agentic AI** has moved beyond scripted chatbots. AI agents reason, plan, call tools, query databases, and collaborate — with human oversight when needed. For developers, founders, and automation teams, the real question is no longer "should we build an agent?" but **which framework to choose** among a dozen mature options.

This guide reviews the **12 most influential AI agent frameworks** as of June 2026: LangGraph, LangChain, CrewAI, AutoGen, Semantic Kernel, Haystack, PydanticAI, LlamaIndex, OpenAI Agents SDK, DSPy, Agno, and Atomic Agents. Each profile is based on officially documented capabilities — no invented benchmarks. You also get a **decision tree**, an **illustrative comparison**, and the angle we apply at BOVO Digital: pairing code frameworks with **n8n** / **MCP** orchestration to ship in production, not just in demos.

---

## What is an AI agent framework — and why do you need one?

An AI agent typically combines four building blocks: a **language model** that reasons, **memory** that holds context, a **tool layer** (APIs, databases, files, MCP), and an **orchestrator** that loops until the goal is met. The most common pattern is **ReAct** (Reasoning + Acting): think, act, observe, repeat.

![Typical AI agent architecture](/images/blog/12-frameworks-agents-ia-puissants-2026/1-flowchart-architecture-agent-en.png "Four components of an AI agent: LLM, memory, tools, and orchestrator in a ReAct loop")

Without a framework, you reimplement state management, retries, tool schemas, persistence, and observability by hand. The frameworks below provide those foundations — with different philosophies: stateful graphs, role-based teams, native RAG, strict typing, or automated prompt optimization.

![Taxonomy of AI agent frameworks 2026](/images/blog/12-frameworks-agents-ia-puissants-2026/5-mindmap-taxonomie-en.png "Mind map: orchestration, multi-agents, RAG, reliability, and fast MVP — five framework families")

![Evolution of AI agent frameworks](/images/blog/12-frameworks-agents-ia-puissants-2026/3-timeline-evolution-en.png "2023–2026 timeline: from experimental LangChain agents to MCP, DSPy, and hybrid no-code + code orchestration")

---

## Orchestration and stateful workflows

### 1. LangGraph

**LangGraph** has become the reference for production agents within the LangChain ecosystem. It models workflows as **directed graphs**: nodes (steps), edges (transitions), persistent state, and **checkpointing** to resume after interruption.

**Documented strengths:** stateful execution, human-in-the-loop, multi-agent orchestration, durable scalable workflows.

**Best for:** complex business processes, research assistants, enterprise automation where every conditional branch must be traceable.

**Limitation:** steeper learning curve than a minimal SDK; graph modeling skills required.

### 2. LangChain

**LangChain** remains the most widely adopted toolkit for connecting LLMs to data sources, APIs, and tool chains. It is not agents-only: it also covers linear chains, retrievers, and hundreds of connectors.

**Strengths:** large community, rich integrations, memory/tool management, rapid prototyping, extensive documentation.

**Best for:** teams that want flexibility and fast iteration — often combined with LangGraph for stateful agent logic.

**Note:** n8n builds on LangChain for its AI Agent node, making it a natural bridge between code and visual orchestration. See [n8n AI Agent: turn workflows into intelligent systems](/en/blog/n8n-ai-agent-transform-workflows-intelligent-systems).

### 3. Semantic Kernel

Built by **Microsoft**, **Semantic Kernel** targets teams invested in .NET and Azure. It blends conventional code with AI via **plugins** and orchestrated **planners**.

**Strengths:** enterprise focus, Microsoft integration, reusable plugins, structured orchestration.

**Best for:** large-scale business apps, IT departments standardizing on Azure OpenAI and .NET.

**Limitation:** less ideal if your stack is 100% Python with no Microsoft constraint.

---

## The Multi-Agent Era: Making CrewAI, AutoGen, and LangGraph Collaborate

### 4. CrewAI

**CrewAI** popularized **agent teams** with explicit roles: researcher, strategist, writer, analyst, reviewer. Each agent has a mission; an orchestrator coordinates toward a shared goal.

**Strengths:** intuitive role architecture, multi-agent collaboration, lightweight implementation, productivity focus.

**Best for:** content creation, business operations, research projects with natural task division.

**In production:** combine CrewAI for reasoning with n8n for triggers, queues, and notifications — an architecture we deploy regularly at BOVO Digital.

### 5. AutoGen

**AutoGen** (Microsoft Research / open ecosystem) excels at **agent-to-agent communication** and dynamic conversations involving humans and machines. Agents can debate, refine answers, and run code in controlled environments.

**Strengths:** multi-agent dialogues, flexible orchestration, human oversight, complex reasoning.

**Best for:** research automation, coding assistants, decision systems where multiple perspectives improve outcomes.

**Limitation:** harder to constrain for strict business flows than a fixed-role CrewAI team.

---

## Data, RAG, and enterprise knowledge

### 6. Haystack

**Haystack** (deepset) is a reference for **retrieval-augmented generation** (RAG) and document pipelines. When agents must query large PDF corpora, internal wikis, or vector stores, Haystack structures indexing, retrieval, and generation.

**Strengths:** advanced retrieval, modular RAG pipelines, vector DB integrations, scalable open-source architecture.

**Best for:** knowledge management, internal search, document intelligence.

### 7. LlamaIndex

**LlamaIndex** evolved from a data indexing framework into a full platform for **data-aware agents**. It connects LLMs to structured and unstructured sources with varied retrieval strategies.

**Strengths:** data-centric architecture, advanced indexing, flexible RAG, multi-provider LLM integration.

**Best for:** research assistants, enterprise search, applications where retrieval quality is everything.

**Complementarity:** Haystack shines on industrial document pipelines; LlamaIndex on versatile data-aware agents. For RAG and hallucinations, see [Your AI is dumb — and that's normal: RAG explained](/en/blog/your-ai-is-dumb-and-thats-normal-rag).

---

## Reliability, typing, and optimization

### 8. PydanticAI

**PydanticAI** builds on **Pydantic** for **structured, typed outputs**. No more malformed JSON: the framework validates model responses before they reach your application.

**Strengths:** structured generation, Python type safety, simplified debugging, native developer experience.

**Best for:** agent APIs, data extraction, any flow where invalid output breaks downstream logic.

### 9. DSPy

**DSPy** (Stanford) shifts the paradigm: instead of hand-crafted prompts, you define **goals** and **metrics**; the framework **optimizes** model interactions automatically.

**Strengths:** automated optimization, less manual prompt engineering, measurable iterative improvement.

**Best for:** advanced systems where performance must improve with evaluation data — more research and data teams than express MVPs.

### 10. OpenAI Agents SDK

The **OpenAI Agents SDK** (OpenAI documentation, 2025–2026) offers a minimal surface to build agents with tools, multi-agent handoffs, and integrated tracing on OpenAI models.

**Strengths:** streamlined developer experience, native tool integration, fast deployment, tracing.

**Best for:** prototypes and products standardized on OpenAI targeting time-to-market.

**Limitation:** vendor dependency; plan a multi-provider abstraction layer for critical production (covered in our resilience-focused articles).

---

## Lightweight, modular, and MVP-focused

### 11. Agno

**Agno** (formerly Phidata) bets on **lightweight** setup and speed. Less ceremony than LangGraph, more agent features out of the box than a homegrown script.

**Strengths:** lightweight architecture, fast setup, strong community-perceived performance, flexible integrations.

**Best for:** startups, MVPs, agile teams that need a working agent in days.

### 12. Atomic Agents

**Atomic Agents** pushes **modularity**: reusable components assembled like LEGO bricks. The goal is long-term maintainability as systems grow.

**Strengths:** modular design, reusable components, clean architecture, scalability.

**Best for:** multi-year projects where several teams touch the same agent foundation.

---

## Code (Python/TS) vs Low-Code (n8n): Which framework to choose?

Selection depends on five axes: **orchestration**, **multi-agents**, **RAG**, **output reliability**, and **delivery speed**.

The real duel today isn't just between Python libraries, but between a **Code-first** approach (which gives absolute freedom but requires maintenance) and a **Low-Code** approach (like n8n) that lets you plug an agent into your ERP or CRM in minutes without reinventing the wheel. Often, the best B2B architecture involves using LangGraph or CrewAI for the "brain" and n8n for the "arms" (actions).

![Decision tree for choosing an AI agent framework](/images/blog/12-frameworks-agents-ia-puissants-2026/2-flowchart-decision-framework-en.png "Decision tree: multi-agents, RAG, Microsoft stack, or fast deployment point to the right framework")

| Primary need | Frameworks to evaluate first |
|---|---|
| Stateful production workflows | LangGraph, Semantic Kernel |
| Role-based agent teams | CrewAI |
| Dialogue and multi-agent reasoning | AutoGen |
| RAG and documents | Haystack, LlamaIndex |
| Reliable typed outputs | PydanticAI |
| Continuous optimization | DSPy |
| Fast MVP | OpenAI Agents SDK, Agno |
| Long-term modularity | Atomic Agents, LangChain |

![Illustrative radar comparison of four frameworks](/images/blog/12-frameworks-agents-ia-puissants-2026/4-radar-comparatif-en.png "Illustrative radar (relative scale, not an official benchmark): LangGraph, CrewAI, PydanticAI, and OpenAI Agents SDK on orchestration, multi-agents, RAG, simplicity, and production")

> **Methodology note:** the radar above is an **illustrative visualization** to compare profiles, not a third-party published benchmark. Always evaluate on your real use case.

---

## The BOVO Digital angle: code frameworks + n8n / MCP orchestration

At BOVO Digital we do not pit code frameworks against no-code tools. We **stack** them:

1. **Code framework** (LangGraph, CrewAI, PydanticAI…) for reasoning, fine-grained RAG, or complex business logic.
2. **MCP server** to expose internal tools in a standardized way — see [MCP stabilized + A2A protocol](/en/blog/mcp-stable-a2a-protocol-ai-agent-interoperability-april-2026).
3. **n8n** (or Make) for triggers, visual orchestration, retries, alerts, and 400+ business app integrations — detailed in [Connect n8n to an MCP server](/en/blog/connect-n8n-mcp-server-ai-agents) and [Make AI Agents vs n8n](/en/blog/make-ai-agents-vs-n8n-which-to-choose-2026).

This hybrid stack matches what we see in the field: purely code agents struggle with ops (monitoring, scheduling, error handling); purely no-code agents hit ceilings on complex logic. The combination holds up in production.

For a first agent without a custom framework, [Tutorial: build your first autonomous AI agent with n8n](/en/blog/tutorial-create-first-autonomous-ai-agent-n8n) remains the most accessible entry point.

---

## 2026 trends: what comes after frameworks

The agent ecosystem is converging on:

- **Long-term memory** beyond windowed context
- **Multi-step planning** with failure recovery
- **Real-time tools** via MCP and streaming APIs
- **Governance**: observability, quotas, action auditing
- **Interoperability** between agents (A2A protocol) and tools (MCP)

The frameworks listed already embed parts of these capabilities. Your job is to pick what matches your technical maturity **today** while keeping an interchangeable orchestration layer **tomorrow**.

---

## Conclusion: the framework matters less than the overall architecture

As of June 2026, **LangGraph, LangChain, CrewAI, AutoGen, Semantic Kernel, Haystack, PydanticAI, LlamaIndex, OpenAI Agents SDK, DSPy, Agno, and Atomic Agents** form the reference landscape for serious AI agents. None covers everything; each optimizes a trade-off.

**Key takeaways:**

- **Stateful production** → LangGraph leads the list.
- **Readable collaboration** → CrewAI.
- **Proprietary data** → Haystack or LlamaIndex.
- **Output reliability** → PydanticAI.
- **Ship fast** → OpenAI Agents SDK or Agno.
- **Stay in production** → add n8n, MCP, and observability — not just a framework.

The choice you make this week shapes your team's velocity for the next two years. Map your use case, test two finalists on a real scope, then industrialize with orchestration that does not lock you in.

**BOVO Digital** helps companies with audits, framework selection, MCP + n8n deployment, and production rollout with guardrails. [Contact us](https://bovo-digital.tech/en/contact) to scope your first agent in real conditions.

LangGraph, CrewAI, PydanticAI, OpenAI SDK… Python vs Low-Code (n8n) comparison. Discover the best framework for the Multi-Agent era in enterprise in 2026.

12 AI Agent Frameworks (2026): Python vs Low-Code Comparison

# Microsoft Supply Chain Hack: Secure Your Deployments and AI Agents

> *On June 9, 2026, the security community documented a campaign targeting Microsoft's open-source repos linked to Azure and AI tools. Developers who cloned or installed these packages may have exposed their credentials.*

Mass adoption of coding agents — Cursor, Claude Code, GitHub Copilot — has a side effect security teams have feared since 2024: **the developer attack surface has become a gateway to cloud infrastructure**. When an engineer clones an "official" Microsoft repo, installs an npm package, or runs a VS Code extension, they implicitly grant full trust to the software supply chain.

On June 9, 2026, several threat intelligence researchers — via publications from **Parameter**, **OpenSourceMalware**, and **Cloudsmith** — documented a campaign that compromised **roughly 70 GitHub repositories** tied to the **Azure AI Tools** ecosystem and Microsoft development utilities. The mechanism is not a zero-day in Copilot or Claude: it's a **classic supply chain attack**, amplified by the AI context, where malicious code exfiltrates secrets on the developer's local machine.

This article breaks down the timeline, modus operandi, targeted credential types, and **what you must do today** if you work with AI tools, n8n, or Azure/GitHub pipelines — whether you're a freelancer, agency, or enterprise security team.

---

## Timeline: from compromise to public disclosure

Early compromise indicators date back to **May 2026**, according to analyses aggregated by the OpenSourceMalware community. Abnormal commits — modified initialization scripts, altered npm post-install hooks, extended configuration files — were injected into repos maintained under Microsoft's GitHub organization, without immediately triggering public alerts.

Coordinated disclosure on **June 9, 2026** mapped the scope: **70+ impacted repos**, touching Azure SDKs, AI integration examples, and CLI tools used to prototype agents. Microsoft began access rotation and dependency review; the community recommends developers who cloned these repos between May and June 2026 to **treat their credentials as potentially compromised**.

![Microsoft supply chain attack timeline](/images/blog/microsoft-github-azure-outils-ia-compromis-attaque-supply-chain/2-gantt-chronologie-en.png "From the initial May 2026 compromise to the June 9 public disclosure and corrective actions")

This calendar echoes a pattern now recurring in the AI industry: **tool adoption speed outpaces dependency audit speed**. Teams that integrated Cursor or Claude Code in March–April 2026 often cloned Microsoft example repos in parallel to connect agents to Azure OpenAI — creating an exposure window exactly over the compromise period.

---

## Attack mechanism: how secrets are exfiltrated

The operational schema follows a proven model, adapted to the "AI developer" profile:

1. **Injection** — Malicious code is added to a legitimate repo (postinstall script, initialization module, configuration extension).
2. **Distribution** — The developer clones the repo or installs the package via npm/pypi, believing they use an official artifact.
3. **Local execution** — On first CLI, extension, or example script launch, the payload runs with user privileges.
4. **Collection** — Malware scans classic locations: `~/.aws/credentials`, `~/.azure/`, `.env` files, shell history, environment variables exported for AI agents.
5. **Exfiltration** — Data is sent to attacker-controlled endpoints, often via HTTPS requests disguised as "normal" traffic.

![Supply chain attack sequence](/images/blog/microsoft-github-azure-outils-ia-compromis-attaque-supply-chain/1-sequence-supply-chain-en.png "From git clone to silent token exfiltration on the developer machine")

The specificity of this campaign lies in the **target profile**: not production servers attacked directly, but **developer workstations** handling both Microsoft open source and AI tools with broad access (OpenAI tokens, Azure keys, GitHub PATs with wide scopes).

---

## Types of credentials targeted

Analyses published June 9, 2026 converge on a typical distribution of exfiltrated secrets:

![Distribution of targeted secret types](/images/blog/microsoft-github-azure-outils-ia-compromis-attaque-supply-chain/4-bar-secrets-cibles-en.png "Cloud tokens, GitHub PATs, package manager credentials, and local .env variables")

| Secret type | Immediate risk | Action |
|-------------|----------------|--------|
| Azure / OpenAI token | Billing access + client data | Revoke + regenerate + 30-day log audit |
| GitHub PAT (repo, workflow) | Code modification, CI/CD exfiltration | Revoke all PATs created before June 9 |
| npm/pypi credentials | Publishing malicious packages in your name | Enable 2FA + granular tokens |
| Local `.env` | Multiple API keys, staging DB | Full rotation + TruffleHog scan |

For agencies like **BOVO Digital**, deploying n8n automations and AI agents for clients, compromising a local `.env` can expose **multiple projects simultaneously** — hence the urgency of systematic rather than targeted rotation.

---

## Expanded attack surface: repos, packages, extensions, CLI

The AI developer ecosystem multiplies entry vectors:

![AI dev tools attack surface](/images/blog/microsoft-github-azure-outils-ia-compromis-attaque-supply-chain/5-class-surface-attaque-en.png "Open source repos, npm packages, IDE extensions, and agent CLIs — four doors to the same risk")

- **Open source repos** — Official examples, unverified forks, "quickstart" templates
- **npm/pypi packages** — Unaudited transitive dependencies
- **IDE extensions** — Filesystem and environment variable access
- **AI agent CLIs** — User-privilege execution, global config access

This map directly overlaps lessons from our article on the [Claude Code npm leak](/en/blog/claude-code-leak-512000-lines-npm-anthropic-2026): the npm supply chain remains the #1 exposure vector for code and secrets in the AI ecosystem. The difference here: **the injection is malicious and intentional**, not accidental.

![Root causes of AI supply chain exposure](/images/blog/microsoft-github-azure-outils-ia-compromis-attaque-supply-chain/6-mindmap-causes-racines-en.png "AI adoption speed, unaudited supply chain, exposed developer workstations, and June 2026 context — four converging factors")

---

## Link to the June 2026 AI context

Three trends converge to explain why this attack makes headlines:

**1. Exploding AI tool budgets.** Uber capped Cursor and Claude Code at [$1,500/month per tool](/en/blog/uber-1500-dollar-monthly-ai-limit-pricing-signal) after burning its annual budget in four months. More engineers using more tools → more tokens stored locally → more value for an attacker.

**2. GitHub Copilot moves to token-based billing** (June 1, 2026). Companies configure organization keys with high caps — exactly the credential type local exfiltration can capture.

**3. MCP server proliferation.** AI agents connect to external tools via the Model Context Protocol. A compromised developer machine can pivot to internal MCP servers, n8n webhooks, and Supabase databases.

The lesson is not to slow AI adoption. It's to **align adoption speed with supply chain hygiene** that most teams haven't industrialized yet.

---

## Immediate checklist for developers and agencies

If you cloned a Microsoft/Azure AI-related repo between **May and June 2026**, apply this sequence:

![Developer post-incident checklist](/images/blog/microsoft-github-azure-outils-ia-compromis-attaque-supply-chain/3-state-reponse-incident-en.png "Response states: inventory, secret rotation, dependency scan, sandbox, hardening, and documentation")

### Step 1 — Inventory (30 minutes)

- List all Microsoft/Azure repos cloned since May 1, 2026
- Identify npm packages installed from `@azure/*`, `@microsoft/*` scopes or `microsoft/*` GitHub repos
- Check VS Code extensions installed from non-official marketplace sources

### Step 2 — Secret rotation (1 hour)

- Revoke **all** GitHub PATs and recreate with minimal scopes
- Regenerate Azure OpenAI, OpenAI API, Anthropic keys
- Change npm passwords if a publish token was on the machine
- Update `.env` files across all active client projects

### Step 3 — Scan and audit (2 hours)

- Run TruffleHog or GitLeaks on recently cloned repos
- Compare suspicious commits with hashes flagged by OpenSourceMalware
- Check Azure AD / GitHub Audit Log for abnormal access

### Step 4 — Industrialize (ongoing)

- Integrate the [secure release checklist with n8n + GitHub Actions](/en/blog/automate-release-checklist-n8n-github-actions-2026)
- Apply principles from [time bombs in automated deployment](/en/blog/time-bombs-deployment-security-automation)
- Review OWASP posture: our [OWASP Top 10 2025](/en/blog/owasp-top-ten-2025-new-web-security-vulnerabilities) guide covers new supply chain categories

---

## Implications for freelancers and automation agencies

The most exposed profiles share three characteristics:

1. **Multi-project** — One compromised `.env` can expose 5–10 clients
2. **Implicit trust** — "It's a Microsoft repo, it's safe"
3. **No SOC** — No security team monitoring exfiltration

For an agency like BOVO Digital, deploying n8n workflows connected to WhatsApp, CRM, and Supabase databases, compromising a developer workstation equals potential access to **production webhooks**, **Meta Business tokens**, and **chatbot encryption keys**.

**Operational recommendation**: separate environments per client (distinct tokens, dedicated machines or containers for sensitive projects), and never reuse a "personal" GitHub PAT on a client repo.

---

## What Microsoft and the community must change

On the vendor side, this incident raises structural questions:

- **Mandatory signed commits** on all high-traffic `microsoft/*` repos
- **SLSA provenance** for packages published on npm under official scopes
- **Detection delay** — Weeks between compromise and disclosure is too long when thousands of developers clone daily

On the community side, OpenSourceMalware databases and Parameter alerts play a critical **collective watch** role — an indispensable complement to official advisories, often published late.

---

## Comparison with other recent AI supply chain incidents

| Incident | Date | Mechanism | Primary target |
|----------|------|-----------|----------------|
| Claude Code npm leak | March 2026 | Accidental source maps | Proprietary source code |
| **Microsoft GitHub Azure** | **June 2026** | **Malicious injection** | **Developer credentials** |
| TrustFall MCP (Adversa) | June 2026 | Hackable MCP agents | Exposed MCP servers |

The complementarity is clear: March exposed **AI tool code**; June targets **user secrets**. Both reinforce the argument for **DevSecOps governance** before accelerating agent deployment to production.

---

## DevSecOps: The Only B2B Response to Supply Chain Flaws

A supply chain attack like the Microsoft/Azure one is no longer an anomaly, it is the new normal. The only way for an SME to protect itself is not to hope that open source repositories are safe, but to implement systemic barriers. DevSecOps automation (via strict n8n and GitHub Actions pipelines) allows you to isolate execution, validate dependencies, and automatically rotate secrets before each deployment. This is the essential shield before entrusting your data to AI agents.

## Audit the Security of Your CI/CD Pipelines with BOVO Digital

Are your deployments vulnerable to this type of attack? BOVO Digital audits your continuous integration pipelines and deploys secure n8n workflows (DevSecOps) to ensure the integrity of your deployments. Protect your developer credentials today. [Request a DevSecOps security audit.](/#contact)

## Outlook: toward an "agent-ready" supply chain

The industry is moving toward pipelines where AI agents themselves modify dependencies (`npm install` triggered by Claude Code, automatic PRs via Copilot). Each autonomous action **multiplies supply chain risk** if not sandboxed.

Emerging best practices for 2026:

- **Container execution** for any script cloned from open source
- **Dependency allowlists** per project, validated in CI
- **Ephemeral tokens** (1 hour) for CI/CD operations
- **Role separation**: the "AI dev" workstation has no production secret access

These measures don't slow innovation — they prevent the scenario where a Tuesday GitHub clone triggers a $50,000 Azure bill on Wednesday.

---

## Conclusion: trust doesn't clone

The June 9, 2026 attack is not a signal to abandon AI tools or Microsoft repos. It's a brutal reminder: **in the coding agent era, the developer workstation is a critical asset**, on par with a production server.

If you have only one action today: **rotate your GitHub PATs and Azure/OpenAI keys**, then audit repos cloned since May 2026. To industrialize: our [n8n release checklist guide](/en/blog/automate-release-checklist-n8n-github-actions-2026) turns these checks into an automatic pipeline.

The race for AI agents won't slow down. The supply chain must catch up — before the next compromise targets your n8n production webhooks directly.

---

## June 2026 series — read by category

| Category | Related article |
|----------|-----------------|
| Tech news | [June 2026 tech recap — Week 1: WWDC, Siri AI, Gemini](/en/blog/recap-tech-juin-2026-semaine-1-wwdc-siri-gemini) |
| Web development | [Next.js 16 production checklist for SMEs without Vercel lock-in](/en/blog/nextjs-16-production-checklist-sme-no-vercel-lock-in-2026) |
| Automation | [Automation agency: 5 n8n workflows we deploy for every client in 2026](/en/blog/automation-agency-5-n8n-workflows-clients-2026) |
| Entrepreneurship | [Outsource automation or hire an ops lead: 2026 decision model](/en/blog/outsource-automation-or-hire-ops-decision-2026) |
| Tutorials | [Tutorial: secure your n8n + GitHub pipeline after the supply chain incident](/en/blog/tutorial-secure-n8n-github-pipeline-after-supply-chain-incident) |

---

*Sources consulted: Parameter (June 9, 2026), OpenSourceMalware, Cloudsmith, GitHub community analyses. Article by BOVO Digital — AI security and automation watch.*

70+ Microsoft/Azure GitHub repos compromised in June 2026. Discover why secure automation (DevSecOps) is the only B2B response.

Fullstack Dev, AI & SEO

DAVY

My Expertises

AI Development & Automation

Fullstack Web & Mobile Development

Web Writing & SEO

Flutter Mobile Applications

Stack & Tools

Déo-Gratias LOKONON

A web, AI or content project that deserves better?

Articles by Singbo Davy

Unsloth Studio & GLM-5.2: How to Run a 744B Local LLM (2026 Tutorial)

12 AI Agent Frameworks (2026): Python vs Low-Code Comparison

Microsoft Supply Chain Hack: Secure Your Deployments and AI Agents