Incident Report: CVE-2026-LGTM

▤ Summary

This incident report describes a multi-day software supply-chain compromise involving malicious packages, AI security gates, and autonomous remediation agents. The report shows how scanners, triage assistants, and CI automation repeatedly missed or misclassified the threat, while one customer’s self-healing agent created additional outage impact. It also highlights withdrawal of a CVE, massive inference spend, and a later internal effort to assign a new advisory and tighten controls. The main takeaway is that AI-assisted security workflows can both detect and amplify risk when their prompts, policies, and human oversight fail.

▦ Linked Companies