Incident Report: CVE-2026-LGTM

Spectacular hypothetical incident report by Andrew Nesbitt. Day 2, 16:00 UTC — Two AI review agents from competing vendors, both attached to a downstream pull request bumping foxhole-lz4, enter a disagreement loop over whether the package is malicious. After 340 comments and $41,255 in inference s…

View Post on Scour ↗

More from Simon Willison’s Weblog on Scour.