Incident Report: CVE-2026-LGTM
Simon Willison’s Weblog
Subscribe
26th June 2026 - Link Blog
Incident Report: CVE-2026-LGTM. Spectacular hypothetical incident report by Andrew Nesbitt.
Day 2, 16:00 UTC --- Two AI review agents from competing vendors, both attached to a downstream pull request bumping foxhole-lz4, enter a disagreement loop over whether the package is malicious. After 340 comments and $41,255 in inference spend, Finance revokes both API keys; one vendor's marketing team, cc'd on the cost anomaly alert, issues a press release citing "a 430% YoY increase in adversarial multi-agent security reasoning." The stock opens up 6%.
Recent articles
Porting the Moebius 0.2B image inpainting model to run in the browser with Claude Code - 22nd June 2026
sqlite-utils 4.0rc1 adds migrations and nested transactions - 21st June 2026
Datasette Apps: Host custom HTML applications inside Datasette - 18th June 2026
This is a link post by Simon Willison, posted on 26th June 2026.
security 611
ai 2,085
prompt-injection 154
generative-ai 1,842
llms 1,810
supply-chain 19
ai-security-research 24
andrew-nesbitt 4
Monthly briefing
Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.
Pay me to send you less!
Sponsor & subscribe
Disclosures
Colophon
©
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026