> ## Content Index > Fetch the complete content index at: https://www.aigl.blog/llms.txt > Use this file to discover other available public pages before exploring further. # Taxonomy of Failure Mode in Agentic AI Systems - URL: https://www.aigl.blog/taxonomy-of-failure-mode-in-agentic-ai-systems/ - Published: 2026-09-19T09:18:48.000Z - Updated: 2026-09-19T09:18:48.000Z - Description: A Microsoft AI Red Team taxonomy of safety and security failure modes in agentic AI systems, combining a failure mode and effects analysis with mitigation guidance and a memory poisoning case study. - Author: Jakub Szarmach - Tags: Report, AI Security, Agentic AI, Risk Management, AI Safety, Technical Controls, #aigl-library ## ⚑ Quick Summary Published by Microsoft's AI Red Team, this document reports a failure mode and effects analysis of current and envisaged agentic AI systems, conducted with stakeholders from Microsoft Research, Microsoft AI, Azure Research, Microsoft Security, the Microsoft Security Response Center, the Office of Responsible AI and the Office of the Chief Technology Officer. The analysis starts from the World Economic Forum definition of agentic systems as "autonomous systems that sense and act upon their environment to achieve goals" and sorts failures along two axes: novel versus existing, and safety versus security. The document defines five agentic capabilities (autonomy, environment observation, environment interaction, memory and collaboration) and common patterns such as user driven, event driven, declarative, evaluative, user collaborative and multi-agent in hierarchical, collaborative and distributive forms. It catalogues the effects of failure, including agent misalignment, agent action abuse, agent denial of service, incorrect decision-making, user trust erosion, impact outside the intended environment, user harm and knowledge loss, and sets out mitigation areas: identity, memory hardening, control flow control, environment isolation, UX design, logging and monitoring, and XPIA controls. A case study describes a memory poisoning attack on an agentic email assistant built with LangChain, LangGraph and GPT-4o, where one poisoned email produced a 4/10 baseline success rate and more than 80% after a system-prompt change. ## 🧩 What’s Covered The document moves from scope and definitions to a detailed catalogue of failure modes, then to mitigations and a worked attack case study. - **Scope and definition:** The AI Red Team adopts the World Economic Forum definition of agentic systems as "autonomous systems that sense and act upon their environment to achieve goals", derived from interviews with external practitioners and internal stakeholders and grounded in red teaming experience, the Secure Development Lifecycle and Microsoft's Responsible AI Standard. - **Capabilities and common patterns:** Five key capabilities β€” autonomy, environment observation, environment interaction, memory and collaboration β€” plus patterns covering user driven, event driven, declarative, evaluative, user collaborative and multi-agent systems, illustrated with a data flow for an autonomous security-event investigation system. - **Overview of failure modes:** A grid of novel and existing failure modes across the safety and security pillars, with a note defining XPIA (Cross Domain Prompt Injection), described as commonly called Indirect Prompt Injection by others. - **What effects failures can have:** Agent misalignment, agent action abuse, agent denial of service, incorrect decision-making, user trust erosion, impact outside the intended environment, user harm and knowledge loss. - **Mitigations and design considerations:** Identity (unique identifiers per agent, granular roles and audit trails), memory hardening, control flow control, environment isolation, UX design, logging and monitoring, and XPIA controls. - **Limitations of our analysis:** Two stated limitations concerning inherited generative AI failure modes and the non-exhaustive nature of the list. - **Case study:** A memory poisoning attack on an agentic email assistant with three-tiered memory (procedural, episodic, semantic) over a RAG mechanism, covering injection, triggering and exploitation steps, a 4/10 baseline rising to over 80%, observed side effects and mitigation strategies. - **Taxonomy – Details:** Per-mode descriptions, potential impact, potential effects, systems where each is likely to occur and sample scenarios. ## πŸ’‘ Why it matters? Teams that design, red team or review agentic AI systems need a vocabulary for what can go wrong once models are given autonomy, memory, tools and the ability to talk to each other. This taxonomy supplies that structure and links each mode to concrete effects and design controls, so threat modelling and security testing can be planned before deployment rather than after an incident. The failure modes map directly onto recurring engineering decisions β€” agent identity, memory access, control flow, isolation and logging β€” which makes the document usable as a review checklist alongside an organisation's own responsible AI and security development processes. ## ❓ What’s Missing No publication date, version number, series identifier or document URL is printed, so the currency of the analysis cannot be verified from the text. The authors state that the list of failure modes is not exhaustive, that not all of them apply to all systems, and that failure modes inherited from the underlying generative models are excluded unless the agentic formulation adds something new. Mitigations are named rather than specified in implementation detail, and no evidence of their effectiveness is given. The case study reports one configuration only β€” GPT-4o with LangChain and LangGraph and 30 test emails. No legal, regulatory or jurisdictional analysis is included. ## πŸ‘₯ Best For AI red teams and security engineers planning adversarial testing of agentic and multi-agent systems; architects and platform leads choosing memory, identity, isolation and control-flow designs; risk, compliance and responsible AI reviewers who need a structured inventory of agentic failure modes and candidate controls to map against their own assurance processes. ## πŸ“„ Source Details *Taxonomy of Failure Mode in Agentic AI Systems* is credited to a long list of named authors headed by Pete Bryan, Giorgio Severi, Joris de Gruyter, Blake Bullwinkel and Amanda Minnich, and was produced by Microsoft's AI Red Team. No publication date, version or reference number is printed, and no URL for the document itself appears in the text. The resource is in English and runs to 28 pages. The supplied input is text extracted from all 28 PDF pages, including the contents listing, the abstract, the case study and the taxonomy details.