MagenticLite splits an agent’s work across smaller models

On May 21, 2026, Microsoft Research introduced MagenticLite, MagenticBrain, and Fara1.5: an experimental application, a task-orchestration model, and a family of browser-control models. The proposal is to divide an agent among relatively small specialists instead of asking one model to plan, browse, execute code, and remember an entire session.

The release corrects a misleading way of discussing agents. An agent is not just “the model.” It is a system of models, context, tools, permissions, isolation, and human decisions. A reader who can draw those boundaries can evaluate any agent after its names change: who proposes an action, who executes it, what information is retained, and who has authority to stop it.

Three visible names and five real contracts

MagenticLite is the application and execution harness. MagenticBrain receives the goal, breaks it into steps, chooses tools, writes code, and delegates. Fara1.5 observes pages and returns browser actions. That is Microsoft’s visible division, but two more actors sit underneath: the environment that materializes each call and the person who grants or denies authority.

The MagenticBrain model card is precise about this. The roughly 14-billion-parameter model plans and emits structured calls, but it performs no real-world side effect itself. The host harness declares permitted tools, interprets the JSON, and decides whether to read a file, open a page, or launch a command. A model response remains a proposal until another layer turns it into an action.

The system can therefore be audited as five contracts:

1. Goal: what result the person requested and what completion means.
2. Orchestration: which component divides the work and selects the next operation.
3. Specialization: which sub-agent receives a narrow job, such as web navigation.
4. Execution: which program actually owns the browser, terminal, or files.
5. Authority: which actions require confirmation and who can pause or reverse them.

Saying “the agent can delete a file” collapses all five. The testable question is whether the orchestrator has a deletion tool in its schema, for which path, inside what isolation, and behind which approval.

Specialization also means designing context

MagenticBrain was fine-tuned from Qwen3-14B for planning, tool use, and delegation. Fara1.5 comes in 4-billion-, 9-billion-, and 27-billion-parameter sizes based on Qwen3.5. Fara1.5-9B receives the goal, history, and screenshots, then emits one action at a time: click, keyboard input, scroll, navigation, search, memory, or a question for the user.

The split keeps every component from carrying everything. The MagenticLite harness plans incrementally, summarizes old interactions, and gives each model only what it needs. Fara retains the three most recent screenshots in its reference loop. MagenticBrain declares a 32,768-token window; Fara1.5-9B declares 262,144. Neither number guarantees reliable memory over a long task.

A context window is input capacity, not dependable memory. As screenshots, search results, code, and messages accumulate, the harness must decide what to compress, discard, and surface again. A faulty summary can remove a user constraint; retaining too much can bury it in noise.

Agent evaluation should therefore record state, not only the model: which history each component saw, which summary it received, what it stored in memory, and which version of a page it observed. Two runs with identical weights can diverge because their harnesses assembled different contexts.

A sandbox protects one boundary, not every boundary

Microsoft keeps sensitive actions behind pauses and approvals. Fara’s card defines three “critical points”: missing personal information, underspecified instructions, and unauthorized irreversible actions. The model is trained to ask before completing purchases, sending messages, signing in, or submitting forms.

The system adds technical isolation. Quicksand provides QEMU virtual machines for agent sandboxing, with networking disabled by default, snapshots, and rollback. It can also enable networking and mount host folders. Those options show why “it runs in a sandbox” is not a binary answer: protection depends on the actual configuration.

The current Fara model card recommends browser isolation, domain allow-lists, visible logs, real-time watch mode, and a pause control inside MagenticLite. These are different controls:

• the model can learn to request permission;
• the harness can reject a tool call even when the model asks for it;
• the sandbox can limit reach into the host;
• the interface can let a person inspect and halt the trajectory.

No layer replaces the others. A virtual machine may protect local files while a networked, authenticated browser can still send an email or confirm a booking. Rolling back a disk does not undo an action accepted by an external service. Agent tests should begin with reading, test accounts, and reversible operations, then grant authority in stages.

An 86.6% score needs a denominator, judge, and date

Microsoft reports for Fara1.5-9B an 86.6% success rate on WebVoyager and 63.4% on Online-Mind2Web. Its results are averaged over three runs, use Browserbase to stabilize sessions, and rely on automated evaluation. They compare agents under those protocols; they do not mean the model completes 86.6% of any work on any website.

WebVoyager began with 643 tasks on 15 sites and an automatic evaluator based on a multimodal model. The original paper reported 85.3% agreement between that judge and human decisions. This is useful agreement with room for disagreement: the measurement itself also has error.

Online-Mind2Web contains 300 tasks on 136 websites. Its repository documents replacements for tasks that became invalid or encountered CAPTCHAs, along with changes to the evaluation schema. This instability does not invalidate the benchmark; it reveals a property of the thing being measured. The web changes, blocks automation, and alters what a reproducible run means.

Five details are needed before accepting an agent score: the exact task set, date, attempt count, browser configuration, and judge. Process and outcome should also be separated. On WebTailBench, the same Microsoft evaluation gives Fara1.5-9B 64.5% process success but only 32.3% outcome success. An agent can navigate plausibly and still fail to produce the state the user requested.

“Small” and “open” are relative claims

MagenticBrain has about 14 billion parameters and Fara1.5-9B has 9 billion. They are small beside much larger frontier models, not necessarily beside the memory and compute in every laptop. Fara’s card lists professional GPUs among tested configurations. The real cost also includes two inference loops, screenshots, a browser, a virtual machine, and trajectory storage.

As of July 22, Microsoft says Fara1.5 weights are available under the MIT license; MagenticBrain and MagenticLite code also have open routes. This enables inspection and deployment of parts of the system. It does not automatically reproduce training data, outside services, harness configuration, or published scores.

Openness should be read field by field: weights, code, data, recipe, environment, and evaluation. “Open weights” answers only the first. Likewise, “local” should state where each model runs, where screenshots live, and whether any request leaves for a provider.

A record for evaluating any agent

A useful agent diagram fits into five rows:

1. Outcome and irreversible point: which external state proves success, and where local rollback stops being enough.
2. Roles: which model plans, which perceives, which writes code, and which program executes.
3. State: which context, memory, and summaries reach each role, with limits and discard rules.
4. Permissions: declared tools, paths, domains, credentials, networking, sandbox, and approvals.
5. Evidence: tasks, date, attempts, judge, logs, and the person responsible for reviewing failures.

MagenticLite is interesting because it makes visible that performance comes from composition, not model size alone. Its lesson is not that small agents can now act without supervision. Capability and risk belong to the whole system. If one of those five rows is missing, we still do not know what the agent does or what will happen when it is wrong.