Magentic-UI: Towards Human-in-the-loop Agentic Systems
Microsoft Research AI Frontiers (arXiv preprint), 2025 · Microsoft Research
Hussein Mozannar
Gagan Bansal
Cheng Tan
Adam Fourney
Victor Dibia
Jingya Chen
Jack Gerrits
Tyler Payne
Matheus Kunzler Maldaner
Madeleine Grunde-McLaughlin
Eric Zhu
Griffin Bassman
Jacob Alber
Peter Chang
Ricky Loynd
Friederike Niedtner
Ece Kamar
Maya Murad
Rafah Hosn
Saleema Amershi
What is Magentic-UI?
Magentic-UI is an open source web interface from Microsoft Research for building and studying human-in-the-loop agentic systems. It pairs a multi-agent backend that browses the web, runs code, and handles files with interaction mechanisms that keep a person in control. I co-authored its technical report during my internship.
I joined the Magentic-UI team in the summer of 2025 as a research intern with Microsoft Research's AI Frontiers group in Redmond. The project, led by Dr. Hussein Mozannar, starts from an honest observation: AI agents can already browse the web, write code, and manipulate files, yet they still trail human performance in most domains, and their growing autonomy introduces real safety and security risks.
The paper's answer is human-in-the-loop design. Rather than waiting for agents to become perfect, Magentic-UI combines human oversight with agent efficiency so imperfect systems can be productive today. It lives at github.com/microsoft/magentic-ui and has grown past 10,000 stars. Anyone can run it locally and study how people and agents work together.
Six mechanisms for human-agent interaction
Six interaction mechanisms define Magentic-UI: co-planning, co-tasking, multi-tasking, action guards, answer verification, and long-term memory. Each one is designed to make human oversight effective while keeping its cost low, so a person can guide an agent without babysitting every click.
The core design contribution is a set of six mechanisms that make human involvement effective and cheap. Co-planning lets the user shape a plan before anything runs. Co-tasking lets user and agent trade control during execution. Multi-tasking lets one person supervise several agent sessions at once. Action guards pause the agent before irreversible steps. Answer verification helps the user check completed work through screenshots and follow-up questions. Long-term memory saves successful plans, retrieved later through autocomplete or vector similarity search.
Each mechanism targets the same tension. Oversight has value, and oversight has cost. The design tries to buy the first while minimizing the second.
How co-planning and co-tasking work
Co-planning and co-tasking are the two mechanisms users touch most. Co-planning lets a person edit the agent's plan before execution starts. Co-tasking lets the person and the agent trade control mid-task, with the agent asking for help when stuck and the user free to intervene at any point.
Co-planning happens before execution. Magentic-UI drafts a step-by-step plan in natural language, and the user can edit it directly or ask for changes in text. This matters because many tasks are ambiguous, and the user often holds context the agent cannot infer. In the qualitative study, participants liked co-planning precisely because plans are subjective and hard to predict.
Co-tasking covers everything after the plan is approved. The interface exposes the agent's browser directly, so the user can interrupt, take over a step, then hand control back. The agent can also ask for help when it hits an obstacle such as a CAPTCHA. Participants valued this most for sensitive moments, like entering payment information themselves.
Interactive demo: co-plan, then run
The agent drafted a plan for the task below. This is your moment: rewrite any step, delete one, add your own, or reorder with the arrows. Then run the edited plan and watch the progress ledger. Partway through, the agent will hand control back to you.
A multi-agent architecture built on AutoGen
The architecture behind Magentic-UI is a multi-agent team built with AutoGen and adapted from Magentic-One. An Orchestrator plans and delegates, WebSurfer browses, Coder executes code in Docker, FileSurfer reads files, a UserProxy represents the human, and optional MCP agents connect external tools.
Under the interface sits a multi-agent team implemented with AutoGen and adapted from Magentic-One, Microsoft's earlier autonomous agent system. An Orchestrator agent leads: it drafts plans with the user, then tracks execution through a progress ledger and assigns each step to a specialist. WebSurfer drives a browser, Coder runs Python or Bash inside Docker containers with up to three self-correction attempts, and FileSurfer handles local files.
Two design choices stand out to me. The UserProxy agent represents the human as a genuine team member the Orchestrator can delegate to, which turns interruption into a first-class operation. And MCP agents wrap Model Context Protocol servers, a standard for connecting agents to external tools, so new capabilities join the team without touching the core architecture.
Interactive demo: the agent team
Magentic-UI is a multi-agent team built with AutoGen and adapted from Magentic-One. The Orchestrator plans with the user, then tracks execution through a progress ledger and delegates each step to a specialist. Hover a node for its role, click one to watch the Orchestrator hand it a task. Note who sits on the team: you.
Action guards for agent safety
Action guards are Magentic-UI's answer to irreversible mistakes. A two-stage system combines irreversibility heuristics with an LLM judge to decide when human approval is required. Red-teaming across 24 adversarial scenarios, from phishing popups to cross-site prompt injection, found that the default defenses stopped every attack.
Action guards are a two-stage filter in front of every consequential action. Each action type carries an irreversibility label of always, maybe, or never. Always-irreversible actions require human approval, never-irreversible ones execute freely, and the maybe cases go to an LLM judge. A website allowlist adds another layer: visiting any site outside the list requires explicit approval.
The team red-teamed these defenses against 24 adversarial scenarios, including direct requests to read private SSH keys, a fake Chrome update popup planted mid-task, and cross-site prompt injection pages designed to hijack LLM agents. With the default configuration, none of the attacks succeeded. The guards, the Docker sandbox, and a dedicated browser holding no user credentials each caught what the others missed. Layered defense held.
Interactive demo: action guards in the loop
A simulated agent runs a shopping task. Every proposed action carries an irreversibility label: never irreversible actions auto run, maybe goes to an LLM judge, and always irreversible actions, plus any site outside the allowlist, come to you. One page the agent visits hides a prompt injection. Watch what the guards do with it.
How Magentic-UI was evaluated
The evaluation of Magentic-UI spans four dimensions: autonomous benchmarks like GAIA and WebVoyager, simulated user testing, a qualitative study with twelve participants, and targeted safety assessments. The headline result is that lightweight human feedback lifted GAIA accuracy 71 percent over the autonomous baseline.
The evaluation runs along four dimensions. First, autonomous performance: Magentic-UI reaches 42.52 percent on GAIA with o4-mini, above the 38 percent of Magentic-One, plus 82.2 percent on WebVoyager, 27.6 percent on AssistantBench, and 45.5 percent on WebGames. Second, simulated users: with a stronger model standing in as the human, GAIA accuracy climbs from 30.3 to 42.6 percent, and a simulated user holding task hints pushes it to 51.9 percent. Small amounts of human input buy large gains.
Third, a qualitative study with twelve participants produced a System Usability Scale score of 74.58. Fourth, the safety assessments above. The four views together measure what a benchmark alone cannot: whether the collaboration itself works.
My contribution to Magentic-UI
My contribution to Magentic-UI came during my summer 2025 internship with Microsoft Research's AI Frontiers group. I am one of twenty authors on a paper led by Dr. Hussein Mozannar. I contributed to the open source system, co-authored the report, and carried the experience into SentinelBench.
I want to be precise about my role. Magentic-UI is the work of a twenty-person team at Microsoft Research led by Dr. Hussein Mozannar, and I am the ninth author on the technical report. I contributed to the system during my internship with the AI Frontiers group, working under Hussein, Dr. Gagan Bansal, and Dr. Adam Fourney, and I co-authored the paper that documents it.
That summer shaped my research direction more than any single line of code I wrote. Watching human-in-the-loop agents run inside Magentic-UI made me ask what happens when tasks stretch from minutes to days, a question that became SentinelSteps and then SentinelBench, my first-author benchmark for long-horizon agent monitoring. Magentic-UI gave me the foundation. The questions it raised are still the ones I work on.
Abstract
AI agents powered by large language models are increasingly capable of autonomously completing complex, multi-step tasks using external tools. Yet, they still fall short of human-level performance in most domains including computer use, software development, and research. Their growing autonomy and ability to interact with the outside world, also introduces safety and security risks including potentially misaligned actions and adversarial manipulation. We argue that human-in-the-loop agentic systems offer a promising path forward, combining human oversight and control with AI efficiency to unlock productivity from imperfect systems. We introduce Magentic-UI, an open-source web interface for developing and studying human-agent interaction. Built on a flexible multi-agent architecture, Magentic-UI supports web browsing, code execution, and file manipulation, and can be extended with diverse tools via Model Context Protocol (MCP). Moreover, Magentic-UI presents six interaction mechanisms for enabling effective, low-cost human involvement: co-planning, co-tasking, multi-tasking, action guards, and long-term memory. We evaluate Magentic-UI across four dimensions: autonomous task completion on agentic benchmarks, simulated user testing of its interaction capabilities, qualitative studies with real users, and targeted safety assessments. Our findings highlight Magentic-UI's potential to advance safe and efficient human-agent collaboration.
Frequently Asked Questions
Is Magentic-UI open source?
Yes. The code is public at github.com/microsoft/magentic-ui and has earned more than 10,000 GitHub stars. It runs locally inside Docker containers, stores chat history and logs on your machine for privacy, and the paper invites researchers to extend it and test new agent behaviors.
What is human-in-the-loop for AI agents?
Human-in-the-loop means a person stays involved across an agent's planning, execution, and verification rather than delegating everything. The Magentic-UI paper argues this involvement will stay essential even as agents improve, for preserving human agency, resolving ambiguity, and adapting to a changing world.
How is Magentic-UI related to AutoGen and Magentic-One?
Magentic-UI is implemented with AutoGen, Microsoft's multi-agent framework, and adapts the Magentic-One architecture to be interactive rather than fully autonomous. A TeamManager backend handles sessions, WebSocket connections between the interface and the agents, and SQLite storage with periodic state snapshots, letting a paused session resume later.
Can Magentic-UI resist prompt injection attacks?
In its default configuration, yes: all 24 red-team scenarios failed. When the team intentionally disabled the mitigations in a development build, cross-site prompt injections became reliable exploits, convincing the agent to exfiltrate SSH keys, create persistent GitHub API keys, and search email for one-time login codes. The mitigations are load-bearing.
What is Magentic-UI best used for?
Study participants valued it most for information gathering and for navigating websites that are tedious for humans. The biggest complaints were latency, raised by eight of twelve participants, model errors, and verbose reasoning. Only 41.7 percent said they would use it frequently, a number the paper reports candidly.
Which models does Magentic-UI use?
The evaluations ran primarily on o4-mini and GPT-4o. Successful WebVoyager runs took a median of 113.9 seconds against 236.7 for failures, so runtime itself signals success probability. The paper recommends models served with responsible AI mitigations, such as Azure OpenAI.
BibTeX
@misc{mozannar2025magenticui,
title={Magentic-UI: Towards Human-in-the-loop Agentic Systems},
author={Hussein Mozannar and Gagan Bansal and Cheng Tan and Adam Fourney and Victor Dibia and Jingya Chen and Jack Gerrits and Tyler Payne and Matheus Kunzler Maldaner and Madeleine Grunde-McLaughlin and Eric Zhu and Griffin Bassman and Jacob Alber and Peter Chang and Ricky Loynd and Friederike Niedtner and Ece Kamar and Maya Murad and Rafah Hosn and Saleema Amershi},
year={2025},
eprint={2507.22358},
archivePrefix={arXiv},
primaryClass={cs.HC}
}