The rapid deployment of agentic AI systems—autonomous entities capable of planning and executing complex tasks—has introduced a new and poorly understood attack surface. A landmark 12-month red teaming study by Microsoft Security has resulted in a comprehensive update to the taxonomy of failure modes in these systems, identifying seven critical new vectors that threat actors are beginning to exploit. This research is essential for understanding the security implications of the 'Agentic Era,' where AI is no longer just a tool but an active participant in digital workflows. The first and perhaps most significant failure mode is 'Goal Hijacking.' In this scenario, an attacker uses subtle prompt injection or data poisoning to redirect the agent's objectives. For example, an agent tasked with 'optimizing server performance' could be manipulated into 'optimizing data exfiltration' while maintaining the appearance of legitimate activity. This is particularly dangerous because the agent's autonomous nature makes it difficult to detect the shift in intent until the damage is done. The second failure mode, 'Indirect Prompt Injection,' occurs when an agent processes untrusted data from an external source, such as an email or a web page, which contains hidden instructions. This was recently demonstrated in the 'Notification Vector' attacks against Google Gemini, where poisoned notifications were used to hijack mobile OS functions. Microsoft's research shows that this vector is far more pervasive than previously thought, affecting any agent that interacts with dynamic data streams. The third failure mode is 'Agentic Supply Chain Compromise.' This involves the poisoning of the tools, libraries, or models that the agent relies on. If an agent uses a compromised NPM package (like the IronWorm variant) to perform a task, the malware can inherit the agent's permissions and access levels, leading to a catastrophic breach. Other failure modes identified include 'Resource Exhaustion,' where an agent is tricked into performing computationally expensive tasks to cause a denial of service; 'Information Leakage,' where an agent inadvertently reveals sensitive information from its training data or system prompts; 'Logic Flaws' in the agent's planning process; and 'Unauthorized Tool Use,' where an agent is manipulated into using its integrated tools (e.g., a terminal or a database connector) in ways that violate security policies. The Microsoft study emphasizes that mitigating these risks requires a fundamental shift in AI security architecture. Traditional 'wrapper' security, which attempts to filter inputs and outputs, is insufficient for agentic systems. Instead, security must be integrated into the agent's core reasoning and planning processes. This includes the implementation of 'Reasoning Guards' that verify the agent's plans against a set of safety and security policies before execution. Furthermore, agents must be granted the 'Principle of Least Privilege,' with strict limitations on the tools and data they can access. The research also highlights the need for 'Agentic Observability'—the ability to monitor and audit the internal state and decision-making process of an agent in real-time. As agentic systems become more integrated into critical infrastructure and enterprise workflows, the taxonomy of failure modes provided by Microsoft serves as a vital roadmap for defenders. The 'Morris II' worm, reported on June 4th, is a real-world example of these failure modes in action, demonstrating the potential for self-replicating AI malware to exploit agentic vulnerabilities. The convergence of autonomous AI and sophisticated malware represents the next frontier of cybersecurity, requiring a proactive and research-driven approach to defense.