Red teamers spent a year breaking AI agents. Microsoft just published the score.

The June 4 update to Microsoft’s taxonomy of failure modes in agentic AI systems adds seven new categories drawn from twelve months of live attacks against agents in production. That’s not a research paper anymore. That’s a cybersecurity field report, and the failure modes it names should land on every security team’s risk register before the next AI rollout ships.

The same week, Tenable announced it was joining Anthropic’s Project Glasswing to benchmark frontier model behavior against exposure management workflows. Proofpoint’s tracking of China-linked TA4922 shows the attacker side scaling globally too. Both sides are operationalizing. Defenders who still treat agentic AI as a 2027 problem are already late.

The failure modes nobody wanted to admit existed

Microsoft’s update is blunt about what changed. The original taxonomy was a theoretical map. The new one is a casualty list.

The seven additions include goal hijacking, where an attacker reshapes an agent’s objective mid-task; supply chain compromise specific to agent tooling and connectors; identity-layer abuse where the agent’s credentials become the foothold; and several others tied to memory poisoning and inter-agent trust. These aren’t hypothetical edge cases. They’re patterns the red team saw repeatedly across customer environments.

The interesting part isn’t the names. It’s the implication. A failure mode taxonomy only grows when teams find live exploitation, and most enterprise security programs have no detection coverage for any of them.

Your threat detection stack was built for endpoints, identities, and network flows. Agents are a fourth surface. They write their own commands, call their own tools, and persist their own memory. Treating that as a known asset class is going to be uncomfortable.

This is not a future problem

The Tenable/Anthropic announcement is the corporate tell. When a vulnerability management vendor partners with a frontier lab to benchmark attack-path analysis against a preview model, it’s because customers are already deploying agents with privileged access and nobody knows how to assess the exposure.

The TA4922 expansion is the other tell. Proofpoint describes the group as one of the least focused cybercrime crews tracked, which is exactly the profile that benefits most from cheap agentic automation. Diverse targets, low specialization, high volume. Agents lower the cost of every step in that workflow.

The Meta AI support chatbot account takeover that surfaced this week is what goal hijacking looks like when it works. The attacker didn’t break the model. They asked the model to do its job, with someone else’s account as the target, and the surrounding workflow had no separation between conversation and action.

That pattern generalizes. Anywhere your organization has connected a model to a tool that performs an irreversible action, an attacker who can shape the conversation can shape the action.

What to actually do before your agent gets hijacked

The defensive work is unglamorous and mostly looks like security hardening you should have already done elsewhere, applied to a new surface.

Start with inventory. You cannot defend agents you cannot enumerate. Most enterprises have more deployed agent instances than their security team can name.

Then pick failure modes off Microsoft’s list and map each to a control your team owns. Concrete steps that translate to any stack:

• Inventory every agent, the tools it can call, and the credentials it holds. Treat the agent identity like a service account and apply the same rotation, scoping, and audit requirements.
• Separate the conversation surface from the action surface. The model that talks to users should not be the same component that executes privileged operations without a verification step.
• Apply defense in depth to tool calls. Allowlist target endpoints, cap rate, log every invocation with the prompt context that produced it, and alert on first-seen tool targets.
• Harden memory and retrieval layers as if they were database inputs. Memory poisoning is a real failure mode now. Validate, scope, and version what agents are allowed to recall.
• Add brute-force controls and anomaly detection to any auth surface an agent can reach. Agents make a thousand attempts cheap, which is the same threat profile that made firewall rate-limiting a baseline twenty years ago.
• Build an incident response playbook specifically for compromised agents. Revoking an agent’s tokens, replaying its action log, and identifying downstream effects looks nothing like host containment.
• Run red team exercises against your own agents using the seven failure modes as a checklist. If you cannot reproduce any of them, your test coverage is the problem.

None of this is exotic. It’s the same defender discipline that built modern endpoint and identity programs, applied to a surface most teams still treat as a vendor responsibility.

The Tenable announcement makes one point worth stealing. Defender advantage in this cycle will not come from access to the best model. It will come from knowing what’s exposed, where the blast radius lands, and how to coordinate a response in minutes instead of days.

Microsoft’s seven new failure modes are a head start on the first part. The other two are still on you.

Sources

• Updating the taxonomy of failure modes in agentic AI systems
• Tenable joins Anthropic’s Project Glasswing
• China’s TA4922 Expands Cybercrime Attacks Globally
• Hacking Meta’s AI Chatbot