Incident Report: CVE-2026-LGTM

Summary

Incident Report: CVE-2026-LGTM Spectacular hypothetical incident report by Andrew Nesbitt. Day 2, 16:00 UTC --- Two AI review agents from competing vendors, both attached to a downstream pull request bumping foxhole-lz4 , enter a disagreement loop over whether the package is malicious. After 340 comments and $41,255 in inference spend, Finance revokes both API keys; one vendor's marketing team, cc'd on the cost anomaly alert, issues a press release citing "a 430% YoY increase in adversarial mult

SpinGraph analysis pending — check back after processing.

• Quoting Josh W. Comeau
• Open Source AI Gap Map
• Fable's judgement
• June 2026 newsletter
• llm-coding-agent 0.1a0
• Using DSPy to evaluate and improve Datasette Agent's SQL system prompts