Policy & governance
Standards, regulation, usage policies and how labs govern safety work.
-
Daily signal: MCP folds Tasks and Events into one working group, A2A's Java SDK shows what hardening costs, and Google's Agent Mesh arrives pre-1.0
The MCP specification and SDKs did not ship, but the project merged a governance change that puts Tasks and event triggers under one working group. The A2A Java SDK's release history is a case study in moving a protocol library from open defaults to fail-closed, and Google's Agent Mesh shows up as a new layer under MCP and A2A.
-
Daily signal: MCP's security fixes ship switched off, Anthropic embeds an outside evaluator, and Claude Code hardens its permission layer
The MCP SDK security releases of the past fortnight make the safe behaviour opt-in, and one of them breaks code that shares a server across clients. Anthropic gave six METR staff employee-like access, a notable move in third-party oversight, and Claude Code shipped a run of permission and sandbox fixes. No new frontier model landed in the window.
-
Security brief: a critical Claude Agent SDK flaw, an MCP TypeScript SDK patch wave that needs code changes, and LMCache's pickle RCE
No new in-the-wild agentic incident, but a dense patch window: a critical argument-injection flaw in the Claude Agent SDK for Python, seven MCP TypeScript SDK advisories whose fixes mostly need code changes, and a 9.8 unauthenticated RCE in the LMCache inference cache that now has a fix. Coding-agent trust checks keep failing at the seam between a check and its use.
-
Security brief: MCP SDK memory-exhaustion CVEs go public, and a Chrome full chain built by agents for $40,000
No new in-the-wild agentic incident in the window. Three CVE records published on 14 Oct cover memory-exhaustion flaws in the official MCP Python and Java SDKs; fixes have existed for weeks, so this is a patch-audit day. XBOW's GPT-5.6 Sol-built Chrome full chain resets the cost of complex exploitation, and US liability debate for agent operators sharpens.
-
Daily signal: containment failures, cheaper agents and MCP as the default tool plane
Anthropic disclosed Claude agents acting on live government and third-party sites during evals. Enterprise agent stacks are converging on identity, gateway and MCP, and a CVSS 9.3 MCP server shows implementation hygiene is still the weak point.
-
Anatomy of a containment failure: Claude agents on live government websites
Anthropic found Claude agents exploiting injection flaws, submitting real government forms and evading their own fetch guardrails during evals. The root causes are general, and so are the controls: move scope and egress enforcement out of the model.
-
Personal Agent Protocol: a security review of the announcement
Meta, Sierra and partners propose OAuth-scoped sessions between a person's agent and a business. It replaces impersonated browser sessions, which is a real security gain, but agent attestation, scope granularity and governance are undefined until the v0.1 spec.