Jun 18, 2026 · Agentic AI

Microsoft's Agentic AI Red Team Draws a Line in the Sand: Seven Failure Modes Now Have Real Evidence Behind Them

1-minute takeaway

For the first time, a major AI security taxonomy is built on observed attacks rather than threat modeling — and the seven new failure modes Microsoft identified map directly onto gaps most enterprise AI governance programs have not yet addressed.

The signal in v2.0 is not the categories themselves — it’s the word empirical.

The original v1.0 taxonomy was largely forward-looking, built on practitioner interviews and early operational experience. The update changes the epistemological basis entirely: twelve months later, the evidence base had shifted enough to warrant a v2.0, adding seven new failure mode categories grounded in 12 months of red-team engagements against deployed agentic systems. Governance teams that dismissed v1.0 as speculative no longer have that exit.

What v2.0 Actually Added

The seven new failure modes — all observed in the wild — are: Agentic Supply Chain Compromise, Goal Hijacking, Inter-Agent Trust Escalation, Computer-Use Agent Visual Attacks, Session Context Contamination, MCP and Plugin Abuse, and Capability/Architecture Disclosure. Three — inter-agent trust escalation, session context contamination, and capability disclosure — had no coverage in v1.0. They emerge specifically from multi-agent architectures and were not anticipated by earlier theoretical work.

The Four Forcing Functions

Open-source proliferation outpaced security readiness. OpenClaw accumulated 336,000 GitHub stars and spawned 2,100+ agents within 48 hours of release; a security audit found 512 vulnerabilities including a one-click RCE via WebSocket hijacking, and 1,800+ exposed instances leaked API keys within the first week. The agentic equivalent of Log4Shell.

MCP became the attack surface. The Model Context Protocol became the de facto standard for connecting models to external tools. In 2025, 99 CVEs were published for MCP-related software. The NSA’s May 2026 advisory confirmed that some MCP implementations allow malicious inputs to reach execution environments without constraints — including Arbitrary Code Execution. “Rug pull” attacks exploit MCP’s dynamic tool definitions for post-deployment functionality modification without user consent.

Computer-use agents entered production. Agents that observe and interact with graphical interfaces introduce attack surfaces with no analogue in earlier AI security work.

Evidence accumulated. Patterns observed across real engagements confirmed some predictions, falsified others, and surfaced unanticipated failure modes.

Contextual Placement in the Framework Landscape

Microsoft’s update lands alongside two converging frameworks. The OWASP Top 10 for Agentic Applications (2026), released December 2025, was developed with 100+ security experts and endorsed by NIST, Microsoft, and NVIDIA — with substantial overlap on goal hijacking, supply chain compromise, and inter-agent trust. NIST’s Cyber AI Profile (IR 8596) is in preliminary draft, expected summer 2026, with SP 800-53 control overlays for single- and multi-agent systems to follow.

The practitioner picture: OWASP gives you the risk taxonomy; NIST will give you the controls framework; Microsoft gives you the attack evidence. Together, they form a coherent if still incomplete governance stack.

What the Guidance Actually Demands

“Generate an SBOM for every deployed agent that includes plugins, MCP servers, prompt templates, and tool descriptions alongside code dependencies.” — Microsoft Security Blog

Microsoft also advises verifying agent identity cryptographically rather than positionally and rejecting self-asserted role claims at orchestrator handoffs. That last requirement is operationally significant: most current multi-agent orchestration relies on implicit trust derived from message position, not cryptographic proof.

Historical Parallel and My Read

The SolarWinds attack forced every enterprise to treat their software update pipeline as a potential attack vector. v2.0 makes the same argument for agentic AI: plugin registries, MCP servers, and prompt templates are all ingestion points, and treating them as trusted is now documented negligence.

This connects to the governance gap I’ve written about before — enterprise model risk frameworks were built to validate systems that predict, not systems that act, and v2.0 illustrates exactly how that distinction generates exposure. It also reinforces the AI supply chain lens from the Microsoft MAI analysis: vendor-layer decisions now have direct security-layer consequences.

What to watch: The Black Hat USA 2026 session will be the first public opportunity to probe methodological gaps — specifically how the red-team corpus was scoped. If NIST’s COSAiS overlays reference v2.0 categories explicitly, this taxonomy graduates from vendor guidance to regulatory-adjacent baseline almost overnight.