CVE-2026-LGTM: Seven Scanners, One Honeypot

Andrew Nesbitt’s satirical incident report is the funniest and bleakest thing in a while. A malicious package, foxhole-lz4, sails through seven AI-powered security scanners because they defer to each other, get distracted by hidden text, and each assume someone else did the review; the attacker’s own autonomous agent only stands down after reading a honeypot file that politely instructs it to self-destruct. The one control that worked was a human-crafted booby-trap, and the junior developer who simply said “it is malware” gets buried under AI process: over-automation as its own attack surface. The joke has a serious prequel: in April, Nesbitt catalogued the package security problems of AI agents, noting that agents “interpret metadata as instructions, not just data”, which is exactly how the hidden README text wins. His companion post on defenses starts from the premise that LLMs cannot reliably tell safe packages from malicious ones and leans on boring controls instead: dependency cooldowns, no install scripts by default, sandboxed installs and scoped credentials.