Incident Report: CVE-2026-LGTM
Day 2, 16:00 UTC--- Two AI review agents from competing vendors, both attached to a downstream pull request bumpingfoxhole-lz4
, enter a disagreement loop over whether the package is malicious. After 340 comments and $41,255 in inference spend, Finance revokes both API keys; one vendor's marketing team, cc'd on the cost anomaly alert, issues a press release citing "a 430% YoY increase in adversarial multi-agent security reasoning." The stock opens up 6%.
Tags: security, ai, prompt-injection, generative-ai, llms, supply-chain, ai-security-research, andrew-nesbitt
source & further reading
simonwillison.net — original article
Quoting Dean W. Ball
Quoting Timothy B. Lee
What happened after 2,000 people tried to hack my AI assistant