c/programmer_humor · by shape_warrior_t@programming.dev · 47d

Incident Report: CVE-2026-LGTM

https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html

Found this on Lobsters, thought it was an entertaining read. For more context, you might want to read the previous instalment, CVE-2024-YIKES (also linked early on in the post itself).

57 points · 8 comments · view on lemmy.world

8 Comments

LPThinker@lemmy.world · 13 pts · 47d (1 reply)

Depressingly plausible scenario. Software needs to become a licensed engineering field with professional liability or something soon!

evadersnack@sopuli.xyz · 1 pts · 40d

That future cannot come soon enough.

RustyNova@lemmy.world · 9 pts · 47d

I was about to share it, then I saw it's satire.

Urgh

Dadifer@lemmy.world · 7 pts · 47d

The future is so much stupider than we anticipated.

Lojcs@piefed.social · 3 pts · 47d (1 reply)

This was very entertaining until I realized it's untagged satire. Now I'm pissed

Edit: Nvm, it is tagged satire I just didn't read the low contrast text

PumaStoleMyBluff@lemmy.world · 1 pts · 47d

I wasn't sure until I read that "ThreatNuzzle" got hung up on furry porn.

Scoopta@programming.dev · 3 pts · 47d

The most depressing thing about this for me wasn't all the AI satire... although it was quite amusing. It's the fact that in 2026 the endpoint is still IPv4 😭

Jakylla@jlai.lu · -4 pts · 47d

Summary

A malicious package passed seven independent AI-powered security gates, each of which failed to stop it for a different reason, none of which was “the code is safe.” The incident was resolved when the attacker’s autonomous agent read a file it shouldn’t have, which is also how the incident started.

Seven LLMs were arranged in series. Six assumed another had read the code; the seventh read it and apologised.

Key Learnings

A cross-functional Agentic Security Working Group has been chartered, replacing the cross-functional Security Working Group established after CVE-2024-YIKES, which never met. The new working group’s kickoff has been scheduled by an AI calendaring assistant into the same slot as the CVE-2024-YIKES retrospective. The calendaring assistant has marked both as Tentative.