Incident Report: CVE-2026-LGTM

4 months ago by shape_warrior_t to c/programmer_humor

A series of unfortunate agents.

Found this on Lobsters, thought it was an entertaining read. For more context, you might want to read the previous instalment, CVE-2024-YIKES (also linked early on in the post itself).

LPThinker 13 points 4 months ago

Depressingly plausible scenario. Software needs to become a licensed engineering field with professional liability or something soon!

save

path: 0 24466794, hotness: undefined, score: 13, children: 1

evadersnack 1 point 4 months ago

That future cannot come soon enough.

save

path: 0 24466794 24596943, hotness: undefined, score: 1, children: 0

RustyNova 9 points 4 months ago

I was about to share it, then I saw it's satire.

Urgh

save

path: 0 24466614, hotness: undefined, score: 9, children: 0

Dadifer 7 points 4 months ago

The future is so much stupider than we anticipated.

save

path: 0 24467754, hotness: undefined, score: 7, children: 0

Lojcs 3 points 4 months ago

This was very entertaining until I realized it's untagged satire. Now I'm pissed

Edit: Nvm, it is tagged satire I just didn't read the low contrast text

save

path: 0 24470344, hotness: undefined, score: 3, children: 1

PumaStoleMyBluff 1 point 4 months ago

I wasn't sure until I read that "ThreatNuzzle" got hung up on furry porn.

save

path: 0 24470344 24474822, hotness: undefined, score: 1, children: 0

Scoopta 3 points 4 months ago

The most depressing thing about this for me wasn't all the AI satire... although it was quite amusing. It's the fact that in 2026 the endpoint is still IPv4 😭

save

path: 0 24473918, hotness: undefined, score: 3, children: 0

Jakylla -4 points 4 months ago

Summary

A malicious package passed seven independent AI-powered security gates, each of which failed to stop it for a different reason, none of which was “the code is safe.” The incident was resolved when the attacker’s autonomous agent read a file it shouldn’t have, which is also how the incident started.

Seven LLMs were arranged in series. Six assumed another had read the code; the seventh read it and apologised.

Key Learnings

A cross-functional Agentic Security Working Group has been chartered, replacing the cross-functional Security Working Group established after CVE-2024-YIKES, which never met. The new working group’s kickoff has been scheduled by an AI calendaring assistant into the same slot as the CVE-2024-YIKES retrospective. The calendaring assistant has marked both as Tentative.

save

path: 0 24465573, hotness: undefined, score: -4, children: 0

Summary

Key Learnings

Rules

Rules