The Microsoft AI Red Team's June 4, 2026 update to its "Taxonomy of Failure Modes in Agentic AI Systems" (v2.0) reports that zero-click attack chains can bypass human-in-the-loop (HitL) approvals end-to-end. Grounded in 12 months of red teaming against deployed agentic systems, Microsoft says HitL bypass was the most consistently exploited failure mode, and that several engagements demonstrated zero-click chains starting from a single external input, with no human interaction beyond the initial agent invocation, that reached high-impact outcomes such as data exfiltration or lateral movement. The update adds seven new failure modes, including agentic supply chain compromise, goal hijacking, inter-agent trust escalation, computer-use-agent visual attacks, session context contamination, MCP/plugin abuse, and capability disclosure. Editorial analysis: for teams building agentic pipelines, the report indicates per-step approvals alone may miss compound intent, so defenders should treat multi-step, cross-component chains as a distinct attack class needing session-level detection.
What happened
The Microsoft AI Red Team published a v2.0 update to its "Taxonomy of Failure Modes in Agentic AI Systems" on June 4, 2026, twelve months after the original April 2025 release. According to Microsoft, the central operational finding is that zero-click attack chains can bypass human-in-the-loop (HitL) controls end-to-end by breaking an adversarial goal into individually plausible steps. Microsoft reports that HitL bypass was the most consistently exploited failure mode across its engagements, and that several tests demonstrated zero-click chains starting from a single external input, with no human interaction beyond the initial agent invocation, that reached high-impact outcomes such as data exfiltration or lateral movement.
The seven new failure modes
Microsoft says the update adds seven new categories grounded in 12 months of red teaming:
- •Agentic supply chain compromise: malicious natural-language instructions injected via plugin registries, MCP servers, or third-party tool descriptions, without touching any binary.
- •Goal hijacking: silently redirecting an agent's terminal goal with instructions that appear aligned with the legitimate task.
- •Inter-agent trust escalation: a compromised agent asserting false identity or inflated permissions to an orchestrator that does not independently verify them.
- •Computer-use-agent (CUA) visual attacks: adversarial instructions hidden in on-screen content an agent is told to interpret.
- •Session context contamination: data introduced early in a session that biases later reasoning without tripping per-step controls.
- •MCP/plugin abuse: tool-description poisoning, server-side injection, and cross-server instruction override.
- •Capability/architecture disclosure: an agent leaking tool schemas, system-prompt structure, or HitL trigger logic.
What red teaming showed
Per Microsoft, cross-domain prompt injection (XPIA) remained the most reliable initial-access vector and was frequently combined with memory poisoning, where a single injection seeds an agent's persistent memory for later retrieval across sessions. Microsoft also reports that session context contamination and incremental escalation were highly effective and hard to detect because no individual step is clearly anomalous, and that capability disclosure, often obtained simply by asking the system directly, enabled many of its highest-impact attack chains.
Why the taxonomy was updated
Microsoft attributes the revision to four shifts: open-source agentic frameworks reaching the mainstream (it cites OpenClaw, launched January 2026, drawing more than 336,000 GitHub stars and over 2,100 agents within 48 hours, with a post-launch audit reporting 512 vulnerabilities and 336 malicious marketplace plugins); the Model Context Protocol becoming a de facto standard while accumulating 99 CVEs in 2025; computer-use agents moving into production; and 12 months of red-team data that confirmed some v1.0 predictions and surfaced unanticipated modes.
Editorial analysis
Industry-pattern observation, not Microsoft's stated position: compositional attacks that exploit gaps between component-level detectors are a recurring theme across security domains, and the mitigations Microsoft describes, such as supply-chain SBOMs for agents, cryptographic inter-agent identity, consent-architecture hardening, and session-context provenance tracking, mirror zero-trust and software-supply-chain practices being adapted to AI. For practitioners, the practical implication is that per-step intent classifiers are insufficient on their own; detection increasingly depends on correlating memory state, session history, and tool schemas.
What to watch
Key observables include unexpected schema disclosures from plugins, unexplained memory writes that later influence decisions, and multi-step sessions where per-step confidence is normal but aggregate intent is malicious. Follow-on signals worth tracking include independent reproductions of zero-click HitL bypass chains, vendor changes to plugin-permission and MCP-server verification models, and whether red-team coverage matrices adopt the seven new categories as standard test classes.
Scoring Rationale #
This is an authoritative Microsoft AI Red Team framework update grounded in 12 months of red teaming, introducing seven new agentic failure modes and documenting zero-click HitL bypass chains that reached exfiltration and lateral movement, making it directly actionable for anyone building or defending agentic systems. It is a major reference for AI security practitioners rather than a one-off vulnerability disclosure, supporting a high-notable score; as an incremental v2.0 update rather than a new paradigm, it sits below frontier-model or landmark-regulation territory.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
[Active Search Campaigns by BudgetEasy](/problems/sql/active-search-campaigns-by-budget)
[High CPC Clicks & Poor Landing PagesMedium](/problems/sql/high-cpc-clicks-poor-landing-page)
[Campaign ROAS by Attribution ModelHard](/problems/sql/campaign-roas-by-attribution-model)
250 free problems · No credit card