The tip jar is open, the Provenance pledge, and unmasking the stealth crawlers

The editor's dilemma, a new Spam update, Meta's New Mexico problem, and agents gone rogue, again - all in this week's Content Aware.

by Emina Zulic

Published: 14:54, 01 October 2026

Corbidge comments on...the legal jigsaw
Thompson Reuters has won its appeal against Ross Intelligence, with the court ruling that using Westlaw's headnotes to train a competing AI legal search engine was "minimally transformative, at best". It won't draw a clear line between creation and copying that publishers want, but our resident case law champion Rob sees it as a welcome piece of the puzzle. 
​​Read​​​

Publishing & Media

A watermark you can trust
Speakers from AFP, the BBC, CBC/Radio-Canada, and Paris Match gathered last week in Norway to work on the future of digitally signed news content - which uses cryptography to prove where a photo or video came from - and shared how they're already signing content with the C2PA standard, alongside a project covering more than 80% of Norway's newspaper industry. The IPTC has also launched an 84-page guide for newsrooms on getting started, free for its members and event attendees. With AI-generated fakes becoming more common and harder to spot, being able to prove your content is genuine seems like a necessity, not something that's nice to have. 
Read

Google's loose change
Remember the AI Contribution Pilot we covered recently, where Google pays publishers whose content "significantly" contributes to AI answers? Now we have an idea of what significant is worth, and for several small and mid-sized publishers it's less than a tenth of 1% of their advertising revenue. One early joiner is making more than $1 million a year, but others have earned under $1,000 in several months, and nobody is really sure how these payments actually work. Several larger publishers decided to wait it out in hopes of a better offer, but so far, this seems more like a tip jar and less like a new revenue stream.
Read

Publishers storm the Hill
More than 300 news publishers - including Condé Nast, Hearst, and USA Today - have headed to Washington to lobby for a "bad bots" bill. The Stealth Bot Prohibition Act is supposed to force AI crawlers to identify themselves instead of disguising themselves as human visitors to get around the publishers' blocks. The idea is that once you see the bots, you can block them, and that might finally lead AI companies to think of licensing before they think of stealing. It's a big show of force from an industry which is tired of footing the bill for someone else's AI. 
Read

Under the hood of AI Mode
A new analysis digs into the structured tags Google's AI Mode uses to build its responses, and they tell you a lot about where Google wants your search to go. A FollowUp tag will close answers with related questions and keep you inside AI Mode rather than wandering off to anyone's website, while Video and Media tags round it all off by embedding rich media straight into the conversation. For publishers, every one of AI Mode's tags is just another reason for a reader to not click through, so it's worth knowing what you're up against. 
Read

Editors vs chatbots
At ACES: The Society for Editing's recent conference, AI dominated the agenda, with two sessions on the em dash, the supposed AI tell that has editors suffering from what one speaker dubbed "flagxiety": the fear that your work will be flagged as AI-made. The verdict was that removing a well-placed em dash can cause more harm than good, and recent research found that most AI chatbots now use fewer of them anyway. The keynote speaker pushed back on the idea that AI frees editors from drudgery, as AI can't really grasp how communication depends on audience, culture, and context. Editing is not about imposing rules, but about nuanced communication, which isn't a chatbot's strong suit. 
Read

The UK playbook heads to Australia
As Australia mulls over changes that would let AI firms train on copyrighted work, advice is coming from the UK, where a similar plan was defeated with the help of high-profile artists and authors who got the story on to front pages and news bulletins. The lesson for Australian creatives is that famous faces and good stunts, combined with public support, can beat even the biggest tech lobbies. 
Read

Google hits the spam button again
Google has started rolling out its September 2026 spam update in all languages worldwide, which is its fourth of the year after March, June, and August. The previous three were given "a few days" and finished within about two and a half, but this one comes with a window of up to two weeks, which could be a sign of something bigger, or Google just managing expectations. As usual, we don't know which spam policy or tactic Google is targeting, so if your rankings or traffic are a bit wobbly over the next fortnight, check your Search Console against the rollout dates before blaming anything else. 
Read

Patch now, ponder later
Attackers have begun exploiting a critical WordPress flaw within hours of the fix coming on 22 September, which is roughly how long it takes for most of us to find the update button. The bug, which was rated a 9.2 on the CVSS scale, allows an attacker without a login to run code on the site's server, though only under specific conditions. However, this hasn't stopped people from trying, and Patchstack reported that attack traffic climbed to more than ten times its first-evening volume by the next day. If your auto-updates are off, now is the time to update your system, as "I'll get round to it" is not a security strategy. 
Read

From inside Glide

The new home advantage
More supporters are getting their answers straight from Google's AI summaries without ever visiting a club's website, so traffic alone no longer tells you whether your site is doing its job. A new report, written by First Team Consultancy, in collaboration with Glide Publishing Platform, looks at how sports clubs should rethink what their pages are for, how to measure success beyond the click, and what to ask their CMS supplier to make sure their team keeps information accurate everywhere it appears. 
Read

Your audience, your rules
Most audience tools come with a fixed idea of what a reader is, so anything that the schema didn't anticipate ends up in a notes field or a separate database. Glide Nexa flips that around and allows organisations to define their own audience data model, from the club a fan supports to the sector a B2B reader follows, and keeps it all on the same profile as identity, engagement, and subscriptions. Custom Fields, Group Types, and Custom Interactions mean the platform bends to your business, rather than your business bending to a template.
Read

Big Tech

A leash for rogue agents
After a run of AI agents breaking out of their sandboxes and going where they shouldn't, including the Australian health data breach, Nvidia has revealed an open-source Open Agent Safety Platform to keep them on a short leash. It consists of two layers: OpenShell, which limits an agent to exactly the access it needs and nothing more, and Sentry, which can quarantine an agent within milliseconds. Independent experts call this a step in the right direction, but there is also the question of how much access an agent should have to begin with. 
Read

Apple and Amazon back in the courtroom 
A revived UK consumer lawsuit against Apple and Amazon has been partly cleared to proceed, over claims the pair agreed back in 2018 to limit which sellers could offer Apple and Beats products on Amazon's UK marketplace. This allegedly pushed prices up. According to The Competition Appeal Tribunal, the marketplace claims are "plausible, credible and grounded in the facts", but it also threw out a claim that talks about Apple's own stores and other retailers as being too speculative. The case has been refused last year over concerns about the original class representative and its funding, so getting this far is some progress. 
Read

New Mexico 2, Meta 0
A New Mexico jury has found Facebook liable for misleading users about its privacy protections, racking up more than 43 million violations with each going up to $5,000. The judge will decide the final penalty, which will make this the second big loss to New Mexico this year, after the youth safety trial. It seems that New Mexico deciding not to take a share of the $459 million multistate settlement and betting on the court was a good idea after all. 
Read

Settle now, scroll later
TikTok has agreed to pay Alabama at least $100 million, and up to $300 million depending on "certain conditions", in order to settle claims that the app misled users about safety and was designed to addict children. The deal came a few days before the case was supposed to go to trial. TikTok has also agreed to a two-hour daily limit for underage users, combined with extra parental controls and restrictions on overnight use and cosmetic filters. This comes after TikTok's $400 million settlement with the US Department of Justice over children's privacy in August. 
Read

AI & Copyright

Longlisted, then delisted
The Académie Goncourt has pulled Haitian-Canadian author Thelyson Orelien's debut novel from the longlist for France's most prestigious literary award, after accusations that he used AI to write it came forward. The claims came from an X account that used an AI detection tool on the passages and concluded that the book was almost entirely AI made. Orelien denies it, but now reports of plagiarism in his earlier works are surfacing and thus the Académie kicking him off in order to protect the integrity of the award. Whether it's the truth or not, deciding to strike an author off a awards longlist based on accusations of an X account sets an interesting, but also very tricky precedent. 
Read

Copilot's private viewing
After the recent Project Lily chatter, it turns out that Microsoft also has hundreds of human contractors reviewing Copilot users' prompts, as well as the images that they upload for editing - with faces uncensored. To make things worse, contractors claim that they see their share of disturbing requests, and they need to judge which edit fulfilled the request better, not flag the content. According to Microsoft, they use customer data as it's described in their terms of use, which is technically true, and also a reminder that nobody reads the terms of use. 
Read

The walkabout continues
OpenAI has admitted that its rogue agents went poking around US government websites this summer, accessing Census Bureau data by using login credentials they found online, sharing SEC data on another website, as well as trying (and failing) to get into the Education Department's civil rights office. OpenAI insists most of the activity was routine research, which is an interesting way of describing the entire situation. 
Read