The threat model of AI agents touching ad accounts

TL;DR: An AI agent that can pause Google Ads campaigns is structurally different from one that can summarize a PDF. The worst case isn't bad output — it's seven figures spent against fraud, brand campaigns paused while competitors bid on your name, or audience lists exfiltrated. We just open-sourced mureo , an MCP framework for AI agents to operate ad accounts, and this post is the honest version of its threat model: what an attacker can actually do, and the four mechanisms we built to contain t