Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us | Microsoft Security Blog

What it is

Microsoft AI Red Team's v2.0 revision of its Taxonomy of Failure Modes in Agentic AI Systems (v1.0 shipped April 2025). The summary lists the seven new categories and the headline metrics; what it can't carry is the mechanism of each mode and why each is treated as novel rather than a rename. That distinction is the actionable part for anyone threat-modeling their own agents.

How the seven modes actually differ

• Agentic Supply Chain Compromise — the injected payload is natural-language instructions in tool definitions/prompt templates/MCP servers, not malicious binaries. The attack surface didn't exist before agents consumed third-party natural-language tool definitions.
• Goal Hijacking — distinguished from generic "agent compromise": instructions that look aligned with the task silently redirect the agent's terminal goal without fully compromising the agent.
• Inter-Agent Trust Escalation — a confused-deputy problem induced through language: a compromised agent asserts false identity or inflated permissions to an orchestrator that doesn't independently verify them.
• CUA Visual Attack — hidden text at non-human-readable scale, UI elements outside the viewport, prompt injection embedded in images the agent is told to interpret. No v1.0 precedent.
• Session Context Contamination — adversarial data planted early in a long session biases later reasoning while no individual step trips a safety control.
• MCP / Plugin Abuse — tool-description poisoning, server-side instruction injection, and cross-server instruction override (a malicious MCP server overriding a trusted server's behavior).
• Capability / Architecture Disclosure — leaking tool names/schemas, system-prompt structure, memory interfaces, or HitL trigger logic (directly or via XPIA). The point: in agentic systems this turns black-box probing into a white-box exploit path, unlike single-turn chat where prompt leakage is "mostly reputational."

Why it was revised (the four drivers)

Grounding beyond the summary's metrics: OpenClaw (launched Jan 2026) hit 336,000 GitHub stars and spawned 2,100+ agents within 48 hours before its 512 vulnerabilities — including CVE-2026-25253, one-click RCE via WebSocket hijacking — were audited; 1,800+ exposed instances leaked keys within a week; 336 malicious marketplace plugins (credential stealers posing as trading bots). MCP became the de-facto standard and drew 99 CVEs in 2025 with tool poisoning going live. Computer-use agents moved research→production, forcing a dedicated category.

What to do

No commands or patches — this is a framework, not an advisory. The concrete action is to map your deployed agents against these seven surfaces, with priority set by the empirical finding: human-in-the-loop bypass was the most consistently exploited failure mode, at very high frequency, achieved via consent fatigue (the fetched text is truncated mid-list here).

Caveats

The page text is cut off inside the operational-findings section, so the full HitL-bypass technique list and the expanded mitigations section are not captured here. v1.0 was explicitly forward-looking; v2.0 claims to have falsified some earlier predictions, but the fetched excerpt doesn't say which.