CSRF Verification Failed - What could it be?

CSRF refers to cross-site-request-forgery.

The error message "verification failed" means that the CSRF token sent with your form or request does not match the token stored on the server.

This could be due to missing tokens, incorrect context, cookie issues or misconfigured trust origins.

OWASP has done some great work on this.

Reminder: OWASP is the Open Worldwide Application Security Project, formerly known as the Open Web Application Security Project (name was updated in 2023).

Agent Harnesses in MAF

Read more here.

Some harness examples here.

Unsloth 2

Let's look at Unsloth in the real world.

Here is an article on fine-tuning Qwen and Gemma.

Productivity Through Frameworks - A Java Trend Jeopardised by AI

A historical selling point of Java has been productivity through frameworks.  

Spring Boot for example gives dependency injection, security, configuration management and observability without having to assemble everything yourself.  However, downsides include longer startup times, more configuration, more dependency management and more abstraction layers. You can ship faster without it. 

AI coding assistants can generate boilerplate code and large frameworks are not as advantaged in the AI world. Often sticking to a simple language boosted by AI is better than a language with a huge framework attached.  This is partly the reason why Python and Go are thriving.

What is BAML in AI?

BAML, which stands for Basically A Made-up Language, is an interesting take on agentic programming.

It aims to create a language which agents you build in, but at the same time, maintains readability and correctness. It aims to achieve this by hybridly embracing advantages of different languages:

Syntax and readability of TypeScript

Correctness and tooling of Rust

Compile times and concurrency of Go

Dynamism of Python

Amongst its other claims to fame is an agent-first toolchain.

Agent As Config

Microsoft Foundry lets you configure a lot in the way of agents.

Development Perspective

The first thing you do is set the model underlying your agent (there is a 1:1 mapping between agent and model). You can even upload your own model.  You will see DeepSeek and Qwens among Claudes, GPTs and Groks.  Then you have a section to give the agent instructions - what it is meant to do.

Operating Perspective

The Playground AI in Foundry is free; but interactions consume tokens and are billed against your Azure subscription. Specifically - sending prompts to GPT-5 Mini is charged per token. Using agent features outside the model may incur separate charges beyond the model itself.

Documentation on Costs and Quotas

Planning and managing costs

Quotas and Limits

Ultimately managing this requires the right data accesses in RBAC.

Microsoft Agent Framework and Foundry

The philosophy and appearance of Microsoft Foundry is to make agent creation as easy as possible. Consequently, agent creation is effectively reduced to a configuration task.

What then is the value of MAF? There are many, potentially.

You may have a human-in-the-loop approval workflow, you may have custom memory implementation and need some agent-to-agent communication (possibly using protocols like A2A).

Or you may not the like the Azure cloud model of doing things, and prefer local. Then MAF works too.

Model Cards

Anthropic produce model cards for all their new models. They are well worth a read.

Claude Haiku 5.5 (October 2026) is formalised here. The card reports that no new RSP thresholds have been crossed.

Humanity's Last Exam is referenced in the cards.

The Azure.AI.Projects Client Library

The Azure.AI.Projects client library simplifies management and deployment of AI models and agents within the Azure ecosystem. It is fundamental to Microsoft Foundry.

 

If not already added, adding this library will add the following references:

System.IO.Hashing  (for non cryptographic hash values)

System.Security.AccessControl (for ACLs etc)

System.Security.Principal.Windows (for interacting with Windows users and groups)

Plus a load more.

Microsoft Visual Studio October 2026 Update

The October 29th update includes a number of security updates.

This includes a security fix for the Brotli decoder. 

This refers to Google's open source Brotli compression library, which implements a lossless compression algorithm, that uses, among other things, LZ77 (Lempel Ziv coding). The compressed data format is also a formal, Internet RFC - RFC 7932 - Brotli Compressed Data Format. It is used to make websites load faster by compression http content.

Google Antigravity

Google Antigravity is Google's solution for agentic development.

Rough Guide to Microsoft Teams

A few features in Microsoft Teams that are worth noting.

If the meeting is recorded/transcripted then it appears in chat - where it can be downloaded.

Microphone can be tested from audio settings.

To get joining info click on Meeting Info.

Interacting in the meeting:

Click on the hand, or Control-Shift-K, to raise or drop your hand.

You can use reactions (Like, Love) by clicking the Smiley Face.

Meeting host:

Can set a countdown timer in the meeting by clicking on Timer (defaults to 5 minutes)

So what is ONNX?

ONNX (Open Neural Network Exchange), pronounced "Onyx",  is the closest thing the AI industry has to being a "portable executable" for machine learning models.

ONNX Runtime is a success story of ONNX, and GitHub code is here.

You will see references to ONNX in disucssions on MAF, so it's important to know what it is.

Microsoft Agent Framework - Complete

So here it is .. Microsoft Agents

Microsoft Agent Framework can be studied here.

You can also go deeper into Agents and Providers.

Bear in mind AI agentic frameworks are subject to evolution and change. What you learn today, you may have to re-learn in future. What you write today, you may have to re-code in future. If you are ok with that, proceed.

What you get when you install MAF

If you nuget in the Microsoft.Agents.AI framework into your project, you'll get a load of references to stuff like:

Microsoft.Bcl.HashCode
Microsoft.Bcl.Numerics
Microsoft.Bcl.AsyncInterfaces

Microsoft.Extensions.Compliance.Abstractions

Microsoft.Extensions.FileSystemGlobbing

Microsoft.Extensions.AI

Microsoft.Extensions.AI.Abstractions

Google.Protobuf

Microsoft.Extensions.Primitives

System.Numerics.Vectors

System.Numerics.Tensors

System.Text.Json

System.IO.Pipelines

Microsoft.Agents.AI.Abstractions

Microsoft.ML.Tokenizers

A bunch of these require you to accept the MIT license. These include Microsoft.Bcl.HashCode, System.Numerics.Vectors, and Microsoft.Extensions.AI.

dot net add package - doesn't always work

This command needs to be run in the same directory as your csproj - which may be one level down from you solution file.

Example using MAF:

dotnet add package Microsoft.Agents.AI.Foundry --prerelease

This may not always work, depending on your project (it needs to support adding package references through the add package command).

Markdown Glows with "glow"

 glow is a great tool in Linux to read Markdown, properly formatted.

Reconcile Divergent Branches in Git

To reconcile divergent branches in git, you need to choose a strategy. It basically happens because local and remote branches have unique commits.

You can do a git status to get an idea of what might be causing a merge conflict and you can also go to the GitHub webpage to visually inspect branches.

Systems Programming Language Mojo Now Open Source

Code here.

Its core principles include being a member of the Python library.

It differs from Python in that it enables memory management control like in C and C++.

Basically the idea is to easier leverage GPU/TPU advances within the software stack without too much programmer overhead.

Transpilers - The JavaScript Phenomenon

Transpilers became needed for conversion of value-added JavaScript variants into JavaScript.  They work as follows:

1. Parse input code into an Abstract Syntax Tree

2. Perform some syntactic and semantic analysis

3. Emit equivalent code in target language

They are sometimes called S2S compilers (Source to Source compilers).

So Much Google In Windows

Windows IPC is done via named pipes.  To view all named pipes in Windows open PowerShell. Type in:

Get-ChildItem  \\.\pipe\

Gotcha: ChildItem is one word, not Child-Item which you may be tempted to type.

The first time you do this you will see a whole load of references to mojo. For example, pipe name may look something like this: Sessions\1\AppContainerNamedObjects\...\mojo.121343.112312.123123212.

Mojo is a Google library providing an abstraction for IPC across platforms - using Unix domain sockets for Unix and Linux environments and named pipes for Windows. It is used in Chromium and Chromium derived products.