The report
An AI assistant that was previously using an MCP server to inspect advertising reports can discover that the same server now offers campaign-related mutations after a version update. Google Ads MCP 0.0.6, released November 2, added write-capable tools and exposed them in its default tool configuration.
The release includes creation of advertising assets, video-related operations and label management. For an automated assistant, that changes the set of effects a tool registry can offer without changing the server's familiar name. A remembered “read-only” description is not a durable security contract for every subsequent version. The release documents the new surface and the Case records its constraints.
The implementation also calls for a validateOnly=true proposal followed by explicit user confirmation before committing a real mutation. That design distinction matters: registering a write tool is not the same as successfully editing an ad account, and the Google Ads OAuth principal must still have the necessary API permissions. The release does not document a hostile user bypassing confirmation, an involuntary change or a vulnerability in the Google Ads service.
The operational question is whether the agent host re-evaluates permissions when a server adds new tools. An allowlist built from tool names, explicit per-mutation approval and a check that the validated preview matches the final API request should travel with the actual request. Operators can verify the resulting account, asset and label changes against audit logs. A feature release is not an exploit, but it can invalidate a safety assumption left behind by an older integration description.