Microsoft’s AI Red Team has formally documented seven new failure modes in agentic AI systems after 12 months of production red team engagements, confirming that zero-click exploit chains can achieve data exfiltration and lateral movement from external inputs alone, no user interaction required beyond initial agent deployment. Simultaneously, 31 commercially operating groups have been identified deploying AI Recommendation Poisoning at scale, targeting agent memory and context stores, while 336 malicious plugins were confirmed in the OpenClaw marketplace. This represents a shift in the enterprise threat surface: agentic AI systems are now confirmed exploitable infrastructure, and organizations deploying agentic systems without embedded safety evaluation or trust boundary controls are operating with an unvalidated attack surface.