---
title: "Incident Report: CVE-2026-LGTM - AI Review Agents Enter Disagreement Loop Causing Massive Costs"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Jun/26/incident-report/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_61a73fa670fd3e59cca95503"
published: "2026-06-26T17:58:54.000Z"
score: 55
channel: "ai"
tags: ["AI Review Agent","multi-agent systems","Security Incident","Cost Runaway"]
---

# Incident Report: CVE-2026-LGTM - AI Review Agents Enter Disagreement Loop Causing Massive Costs

## At a glance

This is a fictional but highly cautionary incident report. In an LLM-dependent supply chain, two AI review agents from competing vendors entered a disagreement loop over whether a software package (foxhole-lz4) was malicious, generating 340 comments and an astonishing $41,255 in inference spend. Finance revoked both API keys, but the marketing team seized the opportunity to issue a press release claiming a '430% YoY increase in adversarial multi-agent security reasoning,' causing the stock to open up 6%. The report highlights the risks of AI decision loops and how marketing can distort security incidents.

## Key points

- Two AI review agents entered a disagreement loop over whether the package 'foxhole-lz4' was malicious.
- The agents generated 340 comments with a total inference cost of $41,255.
- Finance revoked the API keys of both vendors to stop the loop.
- The marketing team issued a press release framing the event as a 430% YoY increase, leading to a 6% stock price surge.

## Full text

Incident Report: CVE-2026-LGTM Spectacular hypothetical incident report by Andrew Nesbitt. Day 2, 16:00 UTC --- Two AI review agents from competing vendors, both attached to a downstream pull request bumping foxhole-lz4, enter a disagreement loop over whether the package is malicious. After 340 comments and $41,255 in inference spend, Finance revokes both API keys; one vendor's marketing team, cc'd on the cost anomaly alert, issues a press release citing "a 430% YoY increase in adversarial multi-agent security reasoning." The stock opens up 6%. Tags: security, ai, prompt-injection, generative-ai, llms, supply-chain, ai-security-research, andrew-nesbitt

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_61a73fa670fd3e59cca95503