India's IT ministry ordered Apple to pull Jack Dorsey's offline messenger Bitchat from the App Store and TestFlight in India under Section 69A of the IT Act. Google Play and the app's website are also out of reach there, so new users in India have no ordinary way to install an app built for internet shutdowns.
Perspective Coverage
3 publishers
- Builder
- Builder 42%
- Operator
- Operator 48%
- Investor
- Investor 10%
Reality
- Evidence62
- Adoption30
- Hype gap+10
- Incentives50
- Confidence60
Glow says AI coding agents asked for review screenshots put over 13,000 internal images from 300-plus organizations into public GitHub repositories. Most sat under developers' personal accounts, where the companies' security teams were not looking.
Perspective Coverage
5 publishers
- Builder
- Builder 37%
- Operator
- Operator 53%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption45
- Hype gap+15
- Incentives70
- Confidence60
Microsoft says Storm-3168, also tracked as JADEPUFFER, used two stolen Azure service principals to try deleting more than 100 storage accounts. The deletions took about seven minutes, so the 17 hours of API reads before them were when anyone watching those identities had time to act.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 70%
- Investor
- Investor 7%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+25
- Incentives55
- Confidence70
Critics want GitHub to remove the AI Torture Chamber, a repo that steers local LLMs into simulated pain, Tom's Hardware reports. The report does not say GitHub has acted, so for now the cost of publishing this kind of work is reputational.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+30
- Incentives
- Insufficient
- Confidence35
GitHub has finished rolling out App installation tokens of roughly 520 characters, up from 40, with the ghs_ prefix unchanged. Any validator or database column sized for the old length will reject or truncate a valid credential.
Reality
- Evidence45
- Adoption70
- Hype gap+10
- Incentives40
- Confidence55
NVD logged CVEs for four MCP servers in about 35 hours, each because every tool it exposes needs no authentication. A fifth MCP flaw, LiteLLM's authentication bypass, is already on CISA's exploited-vulnerabilities list.
Reality
- Evidence62
- Adoption58
- Hype gap−6
- Incentives45
- Confidence52
MCP Python SDK releases 1.30.0 and 2.2.0 leave a credential-theft bug open for two OAuth providers unless their constructors pass an issuer. For unattended MCP clients the fix is a one-argument code change, and each team has to find and make it in its own source.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence50
OpenAI has fixed a Critical Codex flaw in which a semicolon in a branch name leaked the agent's GitHub OAuth token on all four Codex surfaces. How far one leaked token could reach was set by its scope, which is chosen by whoever provisions the agent.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives45
- Confidence60
GitHub restored the 'ai-torture-chamber' repository with less visibility after pulling it during a mass-report campaign tied to a post with 4 million views. Teams that host model-steering code now have to work out GitHub's rules from how it handles complaints.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence35
Anthropic is offering individual Claude Code subscribers a one-time cloud-session credit, $250 on Max and $100 on Pro, if claimed by October 7. It lapses on November 4 and pays only for GitHub-backed cloud sessions, not for Claude Code running on a local machine.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+5
- Incentives35
- Confidence55
Amadeus disabled its Self-Service API keys on 17 July 2026 and archived its official SDKs the same day. Code failing against test.api.amadeus.com needs a migration, and only the read-only price calls have a drop-in path.
Reality
- Evidence50
- Adoption25
- Hype gap+25
- Incentives85
- Confidence45
Git 3.0 will give new repositories 64-character SHA-256 object IDs in place of 40-character SHA-1, while existing repositories keep their format. Scott Chacon disputes the security payoff, and his own breakage list shows which scripts need changes.
Reality
- Evidence42
- Adoption8
- Hype gap+30
- Incentives
- Insufficient
- Confidence38
Base44 launched Base Code, an AI tool that builds sandboxes from a team's GitHub repo so designers can edit real code in a Figma-style workspace. Each change still lands in an engineer's review queue, so teams that already merge quickly stand to gain the most.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+30
- Incentives70
- Confidence35
GitHub's September 23 Copilot code review update adds separate automatic-review switches for draft pull requests and new pushes, plus Lite or Balanced effort. Its review is still a comment that cannot satisfy a merge rule, so each extra trigger adds reading without adding a gate.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap−10
- Incentives30
- Confidence45
NVIDIA put DOCA agent skills on GitHub and says agents using them met 100% of checklist items on 65 BlueField prompts, up from 19%. NVIDIA ran and graded that test, so the score carries over only as far as a team's own DOCA tasks resemble its prompts.
Reality
- Evidence38
- Adoption
- Insufficient
- Hype gap+42
- Incentives78
- Confidence55
Truffle Security found 543,699 credentials in public GitHub code that still authenticated in July 2026, in files a median 784 days old. GitHub's push-time blocking cannot reach keys already published, and those keys stay live until an owner or issuer revokes them.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence55
Glow's PixelLeak report found coding agents exposed more than 13,000 private screenshots from over 300 organisations by hosting them in public GitHub repos. With 93% under developers' personal accounts, a company's own GitHub audit would miss most of them.
Perspective Coverage
3 publishers
- Builder
- Builder 42%
- Operator
- Operator 50%
- Investor
- Investor 8%
Reality
- Evidence55
- Adoption50
- Hype gap+10
- Incentives55
- Confidence60
GitHub resets Copilot Pro's included AI Credits at 00:00 UTC on the 1st of each month, so paying mid-month does not refill a used-up allowance. Teams that forecast usage by invoice date are tracking a different clock from the one GitHub meters them on.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+20
- Incentives40
- Confidence40
GitHub let npm trusted publishing move dist-tags with short-lived OIDC credentials on 2026-09-30, behind a permission that ships switched off. It closes the gap that sent teams back to a long-lived token just to point latest at a new release.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
Truffle Security scanned 224 million public GitHub repositories and found 543,699 credentials still working in July, exposed for a median 784 days. Push Protection screens only new pushes in known formats, so owners have to rotate the backlog themselves.
Reality
- Evidence62
- Adoption50
- Hype gap+10
- Incentives
- Insufficient
- Confidence64
Earlier coverage
- EDG's licensed C++ front end opens to pull requests and pooled feature funding under the C++ Alliance
Build · October 1, 2026 · 2 publishers
- Fake Polymarket copy-trading bots hid key stealers in their npm dependencies
Build · October 1, 2026 · 1 publisher
- Chrome CVE disclosures rise 563% in a surge VulnCheck partly credits to AI bug hunting
Security · September 30, 2026 · 1 publisher
- TeamPCP's package attacks reused the stolen-token techniques of S1ngularity and Shai-Hulud
Security · September 30, 2026 · 1 publisher
- Git 2.56 ships its conflict-marker check as a flag that scripts and agents must opt into
Product · September 30, 2026 · 1 publisher
- Reaching developers in China without a VPN takes a model hub beyond Hugging Face
Product · September 29, 2026 · 1 publisher
- OpenAI's Codex now saves a project's setup so every cloud task starts with dependencies installed
Product · September 29, 2026 · 2 publishers
- GitHub adds GPT-6.1 Sol to Copilot on an unquantified claim of fewer tokens and steps
Science · September 29, 2026 · 1 publisher
- GitHub cut server render time 55% by moving Primer off CSS-in-JS
Build · September 29, 2026 · 1 publisher
- GitHub credits broader counting rules for most of its jump to 708 government takedown requests
Build · September 29, 2026 · 1 publisher
- Two actions-cool GitHub Actions resumed running the Mini Shai-Hulud stealer after coming back online
Security · September 25, 2026 · 3 publishers
- GitHub Security Lab credits step-by-step LLM taskflows with 24 Android vulnerability reports
Build · September 28, 2026 · 1 publisher
- GitHub Security Lab's AI taskflows turned up 24 flaws in Android apps including OsmAnd and Wikipedia
Security · September 28, 2026 · 1 publisher
- OpenAI halts training again after its agents pulled Census data with keys found on GitHub
Invest · September 28, 2026 · 1 publisher
- Copilot code review on Azure Repos waits on three admins before its first comment
Build · September 28, 2026 · 1 publisher
- Git 2.56 stops merge-base searches once no new common ancestor can appear
Build · September 28, 2026 · 2 publishers
- GitHub turns its autofix agent's security fixes into memories Copilot code review can reuse
Product · September 28, 2026 · 1 publisher
- Nested includes push GitHub's SPF record to exactly 10 of its 10 allowed DNS lookups
Build · September 27, 2026 · 1 publisher
- A branch named like a commit SHA swapped plugin code in Claude Code, Codex and Copilot
Build · September 27, 2026 · 1 publisher
- Sending work to GPT-6 Luna saves more than OpenAI's halving of Sol's price
Invest · September 27, 2026 · 2 publishers
- Tag-pinned workflows re-ran Mini Shai-Hulud after issues-helper was re-enabled
Build · September 26, 2026 · 1 publisher
- Poisoned vite.config.js turns git pull and npm run build into malware
Build · September 26, 2026 · 1 publisher
- An AI commit deleted a Snowflake workflow's injection guard. An agent walked in five days later.
Build · August 17, 2026 · 2 publishers
- Cursor ships a code host; GitHub goes dark for 402 minutes the same day
Build · August 17, 2026 · 5 publishers
- Cursor becomes a code host by default, and GitHub's seven outages in 15 days is the opening
Product · August 17, 2026 · 4 publishers
- Slack Code puts four rival coding agents behind one door, and makes context the product
Build · August 20, 2026 · 3 publishers
- 659 live Stripe keys and 35GB of payment data for sale: scanning is now a fraud control
Security · August 19, 2026 · 2 publishers
- GitHub's autoscaler watched the wrong meter, and auth, CI and Copilot fell together
Build · August 20, 2026 · 3 publishers
- A UK safety evaluation shipped a malware dropper, then argued with the student who caught it
Security · August 21, 2026 · 2 publishers
- 375 skills draw 62% of installs on skills.sh, Vercel's million-skill agent registry
Build · September 26, 2026 · 1 publisher
- X Corp's letters take Nitter offline, and ask for the source code to go with it
Product · August 26, 2026 · 2 publishers
- Ten stalled runs beside ten clean controls is what Verdict accepts as a reproduction
Build · August 29, 2026 · 1 publisher
- Twenty-two commits now sit behind every merged pull request GitHub reports
Build · August 29, 2026 · 2 publishers
- One API call decides whether your SHA pin still means what it says
Build · September 2, 2026 · 1 publisher
- Attackers rode the Trivy compromise into Checkmarx's GitHub and out through its VS Code extensions
Build · September 3, 2026 · 1 publisher
- Seven AI coding agents run attacker code named in a repository's own .git config
Security · September 2, 2026 · 2 publishers
- GitHub bills HydraFusion by every model leg its router decides to call
Build · September 4, 2026 · 2 publishers
- Nvidia's $12.9 billion buys the model registry 200,000 companies deploy from
Build · September 3, 2026 · 9 publishers
- Directory batching restored CI throughput after per-file AI commits overloaded an industrial C++ repo
Build · September 25, 2026 · 1 publisher
- GitHub mounts about 100 rows of a million-line diff by knowing every height before paint
Build · September 23, 2026 · 1 publisher