Card 1 of 6Agents
Your team wants to expose an internal MCP server to agents over the network with no authentication, since it only has read tools for now.
You're the one who signs off. What's the call?
Play the News · Drop #028 · Evening
Ship It or Block It
How it works: 6 cards, about 2 minutes, from this Drop's news. Your streak lives only on this device. It's not legal advice.
Show the answer
Answer: Block it.
Least privilegeA post on the Stack Overflow blog cites a 2026 study finding 40.55% of 7,973 live remote MCP servers exposed tools without authentication, and argues for least privilege and authentication across the full path.
From the Drop: Stack Overflow post: MCP made tools easy; running them securely is the gap
- Card 2 of 6Agents
An agent triages incoming support tickets, pulling related issues and code context, then hands each one to a support engineer who decides the fix.
You're the one who signs off. What's the call?
Show the answer
Answer: Ship it.
Replit's CEO says this is how Replit works: an agent examines tickets first, then a person decides. He says human judgment stays in the middle of the loop.
From the Drop: Replit's CEO says agents triage support tickets before a human decides the fix
- Card 3 of 6Agents
A vendor offers to let its agent deliver a client project end to end, including requirements nobody wrote down, with no engineer checking the result.
You're the one who signs off. What's the call?
Show the answer
Answer: Needs a human.
Human review of client deliverablesIn the FDE-Gym preprint, the best configuration resolved only 14 of 95 delivery tasks, and the authors report finding unstated constraints was the main bottleneck.
From the Drop: Preprint: best AI agent resolves only 14 of 95 customer delivery tasks
- Card 4 of 6Laws
Marketing wants to click accept on a social platform's updated business terms that allow crawling your linked websites for AI training, without asking legal.
You're the one who signs off. What's the call?
Show the answer
Answer: Needs a human.
Contract reviewThe Verge reports Meta's new terms, effective October 30, may let it crawl sites associated with business accounts to train AI. Legal experts and Meta disagree on what they allow, so someone should read them.
From the Drop: Meta's new business terms may let it train AI on publishers' sites, Verge reports
- Card 5 of 6Laws
Your new image feature can produce sexualized images of real people from just a name. The plan is to launch and rely on users behaving well.
You're the one who signs off. What's the call?
Show the answer
Answer: Block it.
Consent of people depictedCNBC reports NYC Council Speaker Julie Menin said she found a sexualized image of herself on Grok within a second, and the council says its probe will guide new AI rules.
From the Drop: NYC Council grills SpaceX's AI policy lead over Grok's sexualized images
- Card 6 of 6Models
After legal approves the license, your team pilots an open-weight coding model on in-house hardware so private source code never leaves your machines.
You're the one who signs off. What's the call?
Show the answer
Answer: Ship it.
Apple says Muse Spark Open runs at over 36 tokens per second on four Mac Studios, and AWS says its SageMaker endpoint runs in your own account. Keeping code on your own infrastructure is the point.
From the Drop: Apple: Muse Spark Open tops 36 tokens a second on four Mac Studios
Games are written by AI from this Drop's sourced items. Scenarios are illustrative.