A collector finds a vulnerability report. A model writes a confident headline. The affected version is missing, and the proposed remediation describes a mitigation as though it were a vendor fix.
The prose may be ready for publication. The evidence is not.
Open the evidence record first
Before editing the draft, a reviewer should be able to inspect a small structured record:
Identity: affected component and advisory identifier
Scope: affected versions and required configuration
Mechanism: attacker input, boundary crossed, action reached
Impact: what the source supports
Status: reported, demonstrated, or observed exploitation
Remediation: fixed version, mitigation, or unknown
Sources: primary evidence and any unresolved conflicts
Decision: approve, reject, or needs more evidence
These fields answer different questions. A proof of concept demonstrates a path under stated conditions. It does not establish exploitation in the wild. A configuration workaround can reduce exposure without fixing the vulnerable code.
Edit one claim at a time
Consider this illustrative draft sentence:
A critical agent flaw is being exploited everywhere, and the platform prevents the attack.
That sentence contains at least four claims: severity, affected component, observed exploitation, and product prevention. Each needs its own evidence.
A source may support only a narrower statement: a specific version permits a specific action under a stated configuration. The appropriate edit keeps those conditions and leaves exploitation status unknown when the source does.
Product claims need separate review. Detecting an unsafe setting does not establish that an exploit was blocked. A runtime control can block an action only when it is deployed on the relevant path and its effective policy denies that action.
Make disagreements visible
When sources conflict, preserve the conflict for review. Do not average version ranges or let the most fluent source win. Prefer the maintainer advisory or original research where it resolves the issue, and record the reasoning.
For example, the MCP Python SDK advisory keeps the assigned identifier, affected version ranges, and remediation separate. Each detail should remain traceable to its source.
Give automation a useful job
Use it to gather sources, detect duplicate events, highlight missing fields, compare changed advisories, and prepare drafts from approved facts.
Keep a recorded reviewer decision attached to the evidence revision. If the source changes materially, reopen the review. Generating more polished wording should never silently turn an unresolved claim into an approved one.
These articles are drafts for editorial review. Source checking and publication approval remain distinct decisions.