For a 5-15 person services agency running Cursor, Windsurf, Claude Code, or any internal agent platform built on the Model Context Protocol on paid-client-work machines, the May 2026 CVE class (Microsoft Security Response Center's CVE-2026-25592 and CVE-2026-26030 against Semantic Kernel on 7 May 2026, OX Security's MCP STDIO supply-chain advisory, and the Windsurf 1.9544.26 prompt-injection-to-MCP-registration path) cannot be cleared by vendor auto-update alone. A 5-step playbook (inventory every machine; pin the patched version and disable auto-update; write a one-page MCP allowlist; disclose AI-IDE use to active clients in writing; schedule a 30-day review) is the agency-level minimum that holds against the question an enterprise client will ask in procurement and against the residual liability the agency carries if a remediation conversation becomes necessary.

Operators register pillar piece on agency-level response to AI-IDE CVE class. 30-day cadence is aggressive because IDE patches ship weekly and a new framework-layer disclosure inside the review window is plausible. Triggers: published vendor benchmark showing tool-configuration enforcement at default in the named IDEs would move toward Partial; a second prompt-injection-to-MCP-registration CVE in the same class within the review window would harden the structural argument and keep Holding; a major 2026 agency-side incident with public post-mortem traceable to one of the named CVEs would either confirm or refute the operational implication; the Anthropic MCP working group shipping a protocol-level revision that distinguishes user-authored from model-authored configuration would move toward Partial. Sibling: AM-157 (enterprise treatment of the same CVE class).