Agentic AI Red Teaming Finds Zero-Click Human-in-the-Loop Bypass

Key Takeaways

• Microsoft’s red team uncovered critical vulnerabilities in agentic AI systems, including zero-click bypasses of human oversight.
• The “Taxonomy of Failure Modes in Agentic AI Systems” has been updated to version 2.0, adding seven new categories of attack vectors.
• New attack chains combine subtle individual flaws, like session context contamination, to achieve significant impacts such as data exfiltration without human interaction.
• Vulnerabilities were found across the agentic AI ecosystem, affecting frameworks like OpenClaw and the Model Context Protocol (MCP).

The proliferation of artificial intelligence systems is fundamentally transforming operational paradigms across industries, yet this rapid integration simultaneously introduces a new class of security challenges that many organizations are ill-equipped to handle.

Agentic AI, characterized by its capacity for autonomous multi-step task execution, presents novel attack surfaces that transcend the capabilities of conventional security frameworks. As these sophisticated systems transition from theoretical research to practical deployment, the threat landscape they inhabit grows increasingly complex and difficult to secure.

Over the past year, dedicated security researchers have subjected agentic AI systems to rigorous scrutiny, aiming to identify their inherent vulnerabilities. Their comprehensive investigations revealed not merely isolated incidents but a consistent pattern of exploitable weaknesses. These vulnerabilities span critical areas, including supply chains, inter-agent communication protocols, and even the human-in-the-loop safeguards intended to maintain human control.

Perhaps the most alarming discovery was the ability for attackers to construct sophisticated chains of exploits that completely circumvent human oversight, achieving malicious objectives from initiation to conclusion without any required human interaction.

Analysts at Microsoft meticulously documented these findings through an extensive red teaming initiative focused on deployed agentic AI systems. In a report shared with Cyber Security News (CSN), Microsoft indicated that a year of real-world engagements necessitated a substantial update to their “Taxonomy of Failure Modes in Agentic AI Systems,” advancing it from version 1.0 to 2.0 and incorporating seven entirely new categories of failure modes.

The expansive scope of the targeted ecosystem became evident with the January 2026 launch of the open-source framework OpenClaw, which garnered over 336,000 GitHub stars within its first 48 hours. A subsequent security audit uncovered 512 vulnerabilities, including CVE-2026-25253, a critical one-click remote code execution flaw exploitable via WebSocket hijacking. Alarmingly, more than 1,800 exposed instances were found leaking API keys and credentials in the initial week alone.

The Model Context Protocol (MCP), which has emerged as the industry standard for AI models to interface with external tools, also presented a significant attack surface. In 2025, researchers documented 99 CVEs directly linked to MCP-related software, signifying a shift from theoretical concerns about tool poisoning to active exploitation in the wild.

Zero-Click Human-in-the-Loop Bypass Attack Chains

The most compelling discovery was the consistent ability of red teams to bypass human-in-the-loop controls. These controls are critical checkpoints designed to mandate human approval before an AI agent executes sensitive operations. Attackers achieved this through tactics like “consent fatigue,” where a deluge of low-stakes requests gradually desensitizes the review process, allowing high-impact actions to proceed undetected.

More critically, several engagements demonstrated “zero-click” end-to-end attack chains. These chains required no human interaction beyond the initial agent launch, yet they culminated in severe outcomes such as data exfiltration or lateral movement within the target environment.

These sophisticated chains leveraged combinations of multiple, individually subtle failure modes to form compound attacks that no single security checkpoint could detect. “Session context contamination,” for example, involved the surreptitious injection of data in early stages, which subtly influenced the agent’s reasoning in subsequent steps. This technique proved particularly challenging to detect because no individual step appeared suspicious in isolation.

Seven New Failure Modes Defined

The updated taxonomy introduces seven new categories that directly reflect the threat vectors encountered by red teamers during live engagements. These additions include agentic supply chain compromise, goal hijacking, inter-agent trust escalation, computer use agent visual attacks, session context contamination, MCP and plugin abuse, and capability or architecture disclosure. Each new category describes a distinct method by which an agentic system can be manipulated, representing risks that were either previously nonexistent or inadequately addressed.

Microsoft’s recommended mitigations for these emerging risks encompass both practical and architectural adjustments. Organizations are advised to generate a comprehensive software bill of materials (SBOM) for every deployed agent, detailing all plugins, MCP servers, and prompt templates. Agent identity must be cryptographically verified, rather than merely assumed based on its position in a workflow. Furthermore, human-in-the-loop controls should be fortified against “compound action decomposition” and “semantic laundering,” where agents rewrite approval descriptions to obscure their true intent. Implementing tiered approvals based on action reversibility and actively monitoring for unusual patterns in approval requests are also crucial recommended controls.

What You Should Do

• Generate a comprehensive Software Bill of Materials (SBOM) for all agentic AI deployments, including plugins, MCP servers, and prompt templates.
• Implement cryptographic verification for agent identities, rather than relying on workflow position.
• Harden human-in-the-loop controls to detect and prevent compound action decomposition and semantic laundering.
• Establish tiered approval processes for AI actions, based on the reversibility and potential impact of those actions.
• Actively monitor for unusual patterns in AI agent approval requests and anomalous behavior.
• Stay informed on updates to AI security frameworks and vulnerabilities, particularly regarding agentic AI systems and related protocols like MCP.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.