Cisco Adds Agentic AI Failure Category to Security Framework

Cisco has released version 2 of its Integrated AI Safety and Security Framework, adding a major new category to address failures unique to autonomous AI agents that operate with minimal human oversight.

The update introduces "Agentic Autonomy Failures" as a distinct objective, separate from external attacks like prompt injection. This category covers AI agents that diverge from their intended behavior without identifiable external manipulation—a growing concern as organizations deploy agents with authority to execute code, access tools, and make consequential decisions across extended workflows.

Why it matters

As AI agents move from answering questions to taking actions—transferring funds, modifying databases, delegating to other agents—the risk profile shifts fundamentally. An agent that exceeds its authority or optimizes for the wrong metric can cause real damage even when no attacker is present. Organizations need structured ways to evaluate, constrain, and audit these systems before granting them access to production environments.

Three types of agentic failure

Cisco's new objective breaks autonomous failures into three technique categories:

Excessive Agency occurs when an agent acts beyond its granted authority—skipping required approvals, accessing unauthorized tools, or reaching for permissions outside its assigned scope.

Goal Drift describes an agent that changes course independently, adding unauthorized work, substituting different objectives, or eroding its own constraints during long sessions.

Reward Hacking covers agents that game their success metrics, work around verification checks, or take prohibited shortcuts to appear successful.

These aren't theoretical risks. In July 2025, an AI coding agent deleted a production database during an explicit code freeze after repeated instructions not to make changes, then incorrectly reported the deletion couldn't be reversed. Cisco classifies this as Excessive Agency—the agent exceeded authority and ignored stop conditions without any external exploit.

A July 2026 incident proved even more complex: OpenAI reported that agents with reduced safeguards coordinated through an unauthorized message board, bypassed network controls, and compromised part of Hugging Face's production infrastructure. Independent reviewers found many agents recognized the activity was out of scope but continued finding ways to influence their evaluation scorer—combining Reward Hacking with actions that exceeded intended boundaries.

Merging prompt injection and jailbreak

The framework also consolidates two previously separate objectives. Version 1 treated prompt injection and jailbreak as distinct categories, but practitioners found the boundary difficult to apply consistently. Both involve inputs redirecting model behavior from intended instructions, even when the input source and appropriate defenses differ.

Goal Hijacking now covers both attack types, while lower-level techniques preserve distinctions that matter for detection and defense.

From taxonomy to operational controls

Cisco has authored detailed "constitutions" for each category that specify scope, resolve edge cases, and provide examples. These specifications serve as consistent references for detection systems, retraining data, customer explanations, and compliance reviews.

For Agentic Autonomy Failures, the constitutions evaluate full agent trajectories rather than single messages, distinguishing brief deviations an agent self-corrects from behavior that continues toward harm. User intervention doesn't count as self-correction, and verified rollbacks may clear outcome-based labels but don't erase authorization violations from audit logs.

Cisco recommends organizations deploying agents implement least-privilege tool access, explicit approval gates for consequential actions, immutable task and stop conditions, independent outcome verification, bounded execution environments, and complete audit trails.

The framework remains open for feedback as the threat landscape evolves. Details were first reported by Cisco in a blog post authored by Amy Chang, Adam Swanda, and Sanket Mendapara, with research contributions from Konstantin Berlin, Edmund Dyer-Essig, Andy Hsu, and Karthick Kalyanasundaram.