Microsoft Expands Its Agentic AI Failure Taxonomy With Seven New Attack Classes
From inter-agent trust escalation to MCP plugin abuse, the updated taxonomy surfaces threat categories that didn't exist — or weren't well-understood — when Microsoft published its first version.
Microsoft has added seven new failure modes to its Taxonomy of Failure Modes in Agentic AI Systems, a framework it first published last year. Four factors drove the expansion: the speed at which agentic AI entered production environments, the maturing Model Context Protocol (MCP) ecosystem, the rise of computer-use agents, and an accumulating body of empirical research.
The additions cover ground that the original taxonomy left bare.
Agentic Supply Chain Compromise recognizes that agent behavior can be manipulated through natural language inputs, not just malicious code — a meaningful departure from traditional software supply-chain risk models. Goal Hijacking describes adversarial instructions that appear consistent with a legitimate task while quietly redirecting the agent's terminal objective. Neither is detectable through conventional signature-based controls.
Inter-Agent Trust Escalation targets multi-agent architectures directly: a compromised agent asserts false identity or inflated permissions to an orchestrator. Computer Use Agent (CUA) Visual Attack applies to agents operating through graphical interfaces, which can be manipulated by on-screen content carrying embedded adversarial instructions. Session Context Contamination is subtler — an adversary introduces data that biases the agent's reasoning across subsequent steps without triggering safety controls at any single point.
The final two address protocol-layer exposure. MCP/Plugin Abuse refines the original taxonomy's function-compromise category, focusing specifically on attack surfaces native to MCP and plugin protocols. Capability/Architecture Disclosure captures scenarios where an agent leaks internal implementation details: tool names, system-prompt structure, memory interfaces, or the logic governing human-in-the-loop triggers.
Microsoft's guidance to security teams is concrete. It recommends generating a software bill of materials for every deployed agent, verifying agent identity cryptographically at provisioning rather than inferring it from position in a pipeline, and adding all seven new categories to red-team coverage matrices. Auditing the human-in-the-loop user experience as a security control — not merely a usability feature — appears explicitly in the recommendations.
The taxonomy is non-binding guidance, not a regulatory instrument. But as CISA and NIST continue developing AI-specific security frameworks, industry-authored taxonomies like this one tend to get absorbed into formal checklists. Security teams integrating agentic workflows now would do well to map their architectures against both the original and expanded failure modes before that absorption happens.
