Incident CVE-2026-LGTM

(nesbitt.io)

157 points | by mooreds 2 hours ago

16 comments

  • nickcw 18 minutes ago
    That is very very funny, and oh so plausible.

    I enjoyed this bit a lot from the timeline

    > Karen Oyelaran finds the payload by reading the source code with her eyes and files a second issue. The triage assistant closes it as “duplicate of #8814.” Issue #8814 is a feature request for dark mode. Karen reopens it. The assistant closes it. Karen reopens it. Karen’s GitHub account is rate-limited for “patterns consistent with automated behaviour.”

    And this - the final sentence is a perfect indictment of the timeline we are in.

    > Two AI review agents from competing vendors, both attached to a downstream pull request bumping foxhole-lz4, enter a disagreement loop over whether the package is malicious. After 340 comments and $41,255 in inference spend, Finance revokes both API keys; one vendor’s marketing team, cc’d on the cost anomaly alert, issues a press release citing “a 430% YoY increase in adversarial multi-agent security reasoning.” The stock opens up 6%.

    I'm joining the goat farming waitlist ;-)

  • Octoth0rpe 35 minutes ago
    The entire post is great, but the acknowledgements section is particularly excellent:

    > Kubernetes (the dog), who was not involved in this incident but whose photo in the #incident-response channel was auto-tagged by the Slack image classifier as “container orchestration diagram (confidence: 0.31)”

  • bilekas 52 minutes ago
    > Duration: 96 hours (billable: 2.1 trillion tokens)

    Now there's a metric that would make my boss nervous.

    > Total inference spend across all parties during the incident window was $1.7M, which Marketing has asked us to start describing as “a record investment in autonomous customer assurance.”

    This is too funny.

    • mawadev 37 minutes ago
      I think at some point we need a different or split up currency/economy, because these values make no sense. Just consider how this inference cost 1.062.500 tomatoes ($1.6) in the physical world.
  • piterrro 45 minutes ago
    (I know its a satire, but could be seen as an actual post mortem of the future incident) This report made me realize there's no place for humans, as it is right now, in the process of building software systems in the future. Reading this incident made me dizzy after few paragraphs because of the cognitive context overload and I lost track multiple times.
    • RaSoJo 40 minutes ago
      I kinda felt it was satire, but then the below quote threw me off:

      > one vendor’s marketing team, cc’d on the cost anomaly alert, issues a press release citing “a 430% YoY increase in adversarial multi-agent security reasoning.” The stock opens up 6%.

      That happens! That is not satire. So i had to visit the comments here to be sure :)

    • unknownfuture 38 minutes ago
      You're absolutely right!

      (In all seriousness it seems this is the dream of a huge number of AI pilled execs dreaming of infinite velocity at a fraction of the cost... velocity pointed where, you ask? Well stop asking or you'll be next.)

    • dbliss 20 minutes ago
      Great satire. The comedy of errors along the way made me realize that this could have happened also with humans instead of bots. But now it’s faster.
  • NooneAtAll3 36 minutes ago
    previously on HN: https://news.ycombinator.com/item?id=48086082 "Incident Report: CVE-2024-YIKES"
  • Procrastes 48 minutes ago
    I actually know a goat rancher who is working to require ag impact studies for data centers in Texas. Sounds like I should give him a call while I can.

    (Also CVE-2026-LGTM would be an awesome name for a Culture ship)

  • yk 22 minutes ago
    > Seven LLMs were arranged in series. Six assumed another had read the code; the seventh read it and apologised.

    And this is why management assumes that one can just automate software developers.

  • pmarreck 53 minutes ago
    This incident report is WILD

        The incident was resolved when the attacker’s autonomous agent read a file it shouldn’t have, which is also how the incident started.
    • piazz 48 minutes ago
      PSA this is satire ;)

      (if you have to say it, that’s how you know it’s good)

    • InsideOutSanta 49 minutes ago
      Seems perfectly cromulent to me. And thanks to Karen Oyelaran for her work.
      • jazzypants 43 minutes ago
        We can only hope she wins her GitHub rate limit appeal soon.

        This was hilarious. I didn't know that I needed AI slop satire in my life.

    • dcrazy 49 minutes ago
      It’s satire.
    • bilekas 47 minutes ago
      Its LGTM actually! And very much not serious! (yet)
  • dvh 28 minutes ago
    Brought to you by the people who've been told repeatedly since mid 90s not to glue SQL strings together.
  • btown 45 minutes ago
    If you're wondering what creats.io is - this is satire!
  • faeyanpiraat 42 minutes ago
    You had me in the first half :)
  • PunchyHamster 39 minutes ago
    Well the part about brand-image-incompatible depictions of firefox logo apparently wasn't a satire
    • gerdesj 23 minutes ago
      This tells you all you need to know about the "fox":

      "This report was reviewed by Legal, who have asked us to clarify that the fox was depicted as over eighteen and that the sunglasses remained on throughout."

  • hasteg 30 minutes ago
    [dead]
  • priyankarr 2 hours ago
    [flagged]
  • windsurfer 48 minutes ago
    Perhaps a [Satire] note should be added to the headline.
    • john_strinlai 46 minutes ago
      its tagged as satire at the very top of the page, first thing under the title

      (also, CVEs are numeric only, so the "LGTM" (looks good to me) and CVE "YIKES" is also a big giveaway, on top of ~all of the text being outlandish)

      • hk__2 40 minutes ago
        > its tagged as satire at the very top of the page, first thing under the title

        Not the first thing, it’s buried in the tags as grey on light grey on white.

        • john_strinlai 34 minutes ago
          >it’s buried in the tags as grey on light grey on white.

          if you happened to miss the tags, reading approximately any of the article should make it pretty clear.

          "This report was reviewed by Legal, who have asked us to clarify that the fox was depicted as over eighteen and that the sunglasses remained on throughout."

    • hbcdbff 21 minutes ago
      Yes, the Americans are waking up, we need to make it abundantly clear to avoid them misunderstanding.
    • unknownfuture 41 minutes ago
      It says a lot about the industry today that this post is somehow running afoul of Poe's Law...