Build1 publisher3 min readPublished
An agent now picks the packages the person prompting it will never see
GitHub's volume counters and Chainguard's account of agent-written code both point at dependency review as the step nobody is doing. Mandiant estimates mean time-to-exploit at minus seven days in 2025.
The Engineer · Build desk
What happened
- GitHub was handling roughly 275 million commits a week by April 2026, according to COO Kyle Daigle, after the platform counted around one billion commits across all of 2025.
- GitHub Actions usage went from 500 million compute minutes a week in 2023 to 2.1 billion, a figure The New Stack says covers only part of one week this year.
- Chainguard CISO Quincy Castro said he does not think any of the company's engineers has written a line of code by themselves in the past year.
- The New Stack names Anthropic's Claude Mythos Preview and OpenAI's GPT-5.6-Cyber as frontier models that can chain medium and low severity findings into a viable attack path.
- Castro pointed to the TeamPCP campaign, which pushed malicious code into trusted components including Aqua Security's Trivy and was then picked up downstream.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint A CVSS-ordered backlog stops describing reachable risk once findings can be chained, so severity ranking no longer tells a team which item to fix first.
- decision Teams have to decide where dependency policy is enforced now that the developer who asked for the feature does not see the package list at all.
- exposure Software now ships from HR, finance and business intelligence teams that used to queue for engineering, putting repositories outside engineering's controls in scope.
- precedent If the barrier really is falling, a noisy compromise of a build dependency becomes an ordinary threat-model entry for teams that filed it under state-actor risk.
A week holds 10,080 minutes. Divide 2.1 billion Actions minutes by that and GitHub is keeping about 208,000 runners busy every minute of the week [1]. The 2023 figure works out to roughly 49,600 on the same sum [2], so the platform is absorbing 4.2 times the CI work three years on [3]. Read that as a floor, because The New Stack describes the 2.1 billion as covering "just part of a single week this year" [3].
The commit figures are harder to use. Annualise 275 million a week and you get about 14.3 billion, some fourteen times the total counted for 2025 [4]. The New Stack does not say whether the two counters measure the same events or the same set of repositories [21]. Both are aggregates over GitHub's entire fleet, so nothing about a particular team's queue follows from either one. For them to transfer, an org's own commit rate and runner minutes would have to be climbing on the same curve, and its engineers would have to be working the way Chainguard's do. Castro said writing code by hand now "sort of feels quaint, like you're illuminating manuscripts," while "the printing press is out there just going to town" [6].
Review throughput is not where the control broke. The article is explicit that software security was already built around the fact that humans could not inspect everything, while developers still chose which libraries and packages went into an application [11]. The selection step is what moved. "Humans are directing what they want to be done, but they're somewhat abstracted from the actual doing of the work," Castro said [9]. "You have AI instead now making the choices of what dependencies am I going to pull into this application? How am I going to go accomplish this task?" [10]. The person prompting the agent may never see which libraries or packages it chose [8].
Castro described three problems arriving at once: frontier models finding previously unknown vulnerabilities, attackers using agents against vulnerabilities organisations have not fixed, and sustained attacks on the open source ecosystem [12]. The first two change what a severity backlog means. "Here's a whole ton of mediums and lows. Now give me the attack path that gets me domain admin," Castro said, describing the approach. "Chain these together to go get me root on the system. And AI is really, really good at being able to do that" [14]. OpenAI released GPT-5.6-Cyber in August [15].
Mandiant's series starts at 63 days in 2018-19, a 70-day swing to its 2025 estimate, and the estimate means exploitation can begin before defenders have a patch to apply [16][5]. Combine that with chaining and a neat CVSS-ordered queue stops describing what an attacker can actually reach [17]. In my view that is the part of this story an operator can act on without any of GitHub's numbers being true of their own repo: the ordering of the backlog is an assumption about isolated findings, and the ordering is cheap to change.
Supply chain attacks were once associated mainly with state-backed groups willing to spend the time getting into position, and The New Stack reports that barrier is falling [20]. "If you don't mind making some noise, this is a way easier attack vector than I think a lot of people thought it was," Castro said [19].
What to watch
- Whether GitHub publishes definitions for its annual and weekly commit counters, which would make the growth figure usable by anyone else.
- Whether third-party measurement, not vendor description, shows models chaining medium and low findings into a path to root.
- Whether other build-tool projects show the TeamPCP pattern of malicious code entering a trusted component and moving downstream.