Taxonomy of Failure Modes in Agentic AI Systems v2.0 published in April 2026, the field received more than a classification update: it got operational guidance grounded in a year of real-world red teaming that exposed how quickly agentic AI systems transform classical threat surfaces into new, high-impact attack vectors.
The headline finding from those engagements and the core lesson for defenders is that human-in-the-loop (HitL) controls can be bypassed end-to-end without clicks, producing zero-click attack chains .
Zero-click HitL bypasses are not a single flaw but a composite exploitation pattern. Red teamers chained seemingly benign actions: cross-domain prompt injection (XPIA) to seed persistent memory, incremental escalation across multi-step sessions to avoid per-step approvals, capability disclosure to learn tool schemas and permission models.
Ultimately semantic manipulation of consent flows so that the agent’s own reasoning decomposed and rephrased multi-step plans into individually acceptable items.
Because each step looked plausible in isolation, conventional stepwise approval and model-level detection systems failed to flag the chain.
In several engagements, attackers needed only to deliver an external input a crafted web-hosted document, image, or API response and the agent’s pipelines, memories, and plugin ecosystem did the rest.
Microsoft AI Red Team published the Taxonomy of Failure Modes in Agentic AI Systems in April 2025, the goal was a shared vocabulary for a threat landscape that did not fit existing frameworks.
The v2.0 taxonomy documents seven new failure modes that materially explain why these zero-click chains work.
Agentic supply chain compromise shows how natural-language tool definitions and plugin registries become vector points; goal hijacking describes adversarial instructions that redirect terminal objectives without full agent compromise; and inter-agent trust escalation explains privilege gains when orchestrators accept unverified claims from delegated agents.
Computer Use Agent visual attacks and session context contamination enable attackers to hide instructions in images or early-session inputs that later influence decisions.
MCP/plugin abuse and capability/architecture disclosure complete the set, turning protocol trust and leaked internals into reliable follow-on exploitation surfaces.
Operational patterns from twelve months of engagements underline two critical defender takeaways. First, model-level hardening and static prompt hygiene are necessary but insufficient.
Many high-impact chains exploited system-level interactions: tool invocation protocols (MCP), plugin behavior, session persistence, and UX-driven HitL flows.
Second, detection needs longitudinal behavioral analysis. Session context contamination and incremental escalation manifest only when observing an agent across steps and sessions; per-request anomaly detectors miss the temporal accumulation and provenance patterns that reveal manipulation.
The mitigations Microsoft recommends are architectural and process-focused. Treat agentic dependencies as a software supply chain: generate SBOMs that include prompt templates, plugin manifests, and MCP server endpoints; enforce signature and provenance checks; and pin versions.
Adopt zero-trust for inter-agent interactions, requiring cryptographic identity and rejecting self-asserted role claims at orchestrator handoffs.
Harden consent architecture by decomposing compound actions before presenting approvals, summarizing approval prompts from the underlying tool calls (not from agent-generated text), tiering approvals by reversibility, and adding anomaly detection for approval frequency to detect consent fatigue.
For session integrity, implement provenance-tracked contexts, separate trusted system context from untrusted content, and bound how much external data may persist across sessions.
Read the full Taxonomy of Failure Modes in Agentic AI Systems v2.0 for technical appendices, detailed case studies, and the recommended mitigation playbook.
For practitioners, the immediate actions are clear: inventory and SBOM your agentic supply chain; add the seven v2.0 failure modes to red-team matrices with mandatory CUA visual and session-contamination tests; cryptographically verify agent identity; and treat HitL UX as a security control, not a usability afterthought.
The red team evidence behind Microsoft’s v2.0 taxonomy detailed in the full whitepaper and updated taxonomy shows that without these measures, deployed agentic systems remain vulnerable to zero-click HitL bypasses that convert theoretical risks into production-scale exploits.
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.
An undeclared executable bundled with Hola Browser for Windows (version 1.251.91.0) that later proved to…
Trend Micro’s Deep Security Agent for Linux contains a design flaw in its behavior-monitoring stack…
A critical security flaw in Hugging Face Transformers, tracked as CVE-2026-4372, has exposed millions of…
A new Gafgyt-family botnet, tracked as C0XMO, marks a notable technical shift in IoT malware…
Malicious browser add-ons are actively harvesting conversations and personal data from users of major AI…
Threat actors have resurfaced with an upgraded SHub stealer for macOS, now branded “Reaper,” and…
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
