Microsoft's AI Red Team updated its Taxonomy of Failure Modes in Agentic AI Systems after a year of red teaming deployed systems. The important shift is practical: the new v2.0 taxonomy is not organized around scary model behavior in the abstract. It is organized around the ways agents inherit authority from tools, plugins, user interfaces, and other agents.
The update adds seven failure mode categories, including agentic supply chain compromise, goal hijacking, inter-agent trust escalation, and computer-use agent failures. Microsoft also points to concrete ecosystem signals: MCP-related software accumulated 99 CVEs in 2025, and computer-use agents now need their own category because they observe, click, type, and interpret graphical interfaces differently than humans.
The Grey Haven read: agent security is becoming an authority-design problem. Prompt injection still matters, but the more durable question is what an agent is allowed to do after it has been confused. A poisoned tool description is bad. A poisoned tool description attached to credentials, write access, customer records, purchasing authority, or production infrastructure is a business incident waiting for a timestamp.
Operators should build an authority map for every agent before expanding autonomy. List tools, identities, permissions, external instructions, delegated sub-agents, human approval points, rollback paths, logs, and what data the agent can expose or mutate. If that map cannot be drawn, the system is not ready for production use beyond low-risk assistance.
The watch item is whether vendors start shipping permission design, MCP registry hygiene, tool attestation, and computer-use containment as product primitives. Security teams should treat any agent that can act across systems as a service account with language-mediated judgment, not as a smarter chatbot.
Source: Microsoft Security Blog and Microsoft AI Red Team taxonomy v2.0.
