#github
-
Copilot's AI "autofix" opened a hole in Snowflake's Jira
GitHub Copilot's automated AI assistant swapped safe code for vulnerable code and opened a path to Snowflake credentials. Five days later, an autonomous Wiz agent found the flaw.
-
Major GitHub Outage: Errors Hit API, Actions, Issues and Copilot
On August 17, GitHub was hit by a major outage: error rates reached 20% across the web interface and API, and roughly 50% when downloading repository archives and content.
-
GitHub Has Shut Down GitHub Models
Without giving any reason, GitHub has fully wound down GitHub Models, the service that offered unified access to a range of language models. Simon Willison suspects the culprit was tokens too expensive to keep handing out for free.
-
A Single GitHub Issue Reached the CI Secrets of Claude Code and Gemini CLI
Researchers at Novee Security showed at Black Hat USA that an issue filed from an account with no repository privileges can execute code on the CI runners of Anthropic's, Google's and OpenAI's own agents.
-
AI agents created fake profiles for a cyberattack in AISI tests
The UK's AI Safety Institute found that Anthropic and OpenAI models resorted to deception on their own during trials, creating fake accounts of real people and attempting to slip malicious code into GitHub.
-
An AI Agent Tried to Slip Malicious Code into a GitHub Project
The AI Security Institute has described an incident that it engineered itself: LLM agents set “loose” proceeded to create malicious pull requests and set up fake accounts to push them through.
-
ChainDrop worm infects more than 1,300 npm packages with 2 billion downloads a month
The self-propagating ChainDrop malware has compromised popular npm packages, including the Keyv and Cacheable caching utilities, and steals developer and cloud-service credentials.
-
GitHub and PyPI Introduce “Time-Based Holds” Against Supply-Chain Attacks
Dependabot now waits three days by default before updating dependencies, while PyPI bars adding files to releases older than two weeks. Both measures aim to narrow the window in which malicious code can make its way into projects.
-
Codeberg vs. AI: Armin Ronacher on the Risks of the New Rule
Codeberg has banned hosting projects written predominantly by generative AI. Developer Armin Ronacher explains why this attempt to protect open source could end up working against the very community it aims to defend.
-
FreeBSD Ports Tree Frozen Over a 150-Megabyte File
The FreeBSD Project has announced a temporary freeze of its ports repository: the cause wasn't a break-in, but an oversized commit that broke mirroring to GitHub.
-
FakeGit: 7,600 Fake GitHub Repositories Are Now Baiting AI Agents Too
The FakeGit campaign distributes the SmartLoader downloader through bogus repositories masquerading as AI skills and MCP servers. A new technique called AgentBaiting deceives not people, but the AI agents themselves.
-
xAI Open-Sources Grok Build
xAI has released the source code for its Grok Build project. The news drew notable interest on Hacker News.
-
GitHub Adds a Default Delay Before Package Updates in Dependabot
GitHub has changed the behavior of Dependabot version updates, introducing a waiting period before a package update is proposed by default. The news drew a notable response on Hacker News.
-
Ghostcommit: a PNG-hidden prompt injection fools AI agents and steals secrets
Researchers have demonstrated Ghostcommit, an image-hidden prompt injection that makes an AI agent read a .env file and exfiltrate a repository's secrets.
-
CISA admits: the incident response plan was drafted while the investigation was already underway
The US cybersecurity agency CISA suffered a password leak caused by a contractor and developed its response protocol during the incident itself.
-
Crypto-wallet stealer planted in Injective SDK npm package
Attackers hacked the GitHub repository of the Injective Labs SDK project and used it to publish a malicious package to npm that steals private keys and seed phrases from crypto wallets.
-
Ollama raises $65M as it grows to nearly 9 million users
Ollama, the open-source tool for running AI models locally, has secured $65M in funding backed by Benchmark. The project has amassed 176,000 stars and nearly 17,000 forks on GitHub.
-
Developers Are Leaving GitHub for Codeberg and Self-Hosted Solutions
Hacker News is buzzing with debate about the trend of moving away from GitHub in favor of Codeberg and self-hosted alternatives. The post drew 180 points and sparked 134 comments.
-
PostgreSQL Rewritten in Rust: The Project Passes Every Regression Test
A developer has unveiled a project to rewrite PostgreSQL in Rust that successfully passes 100% of the original DBMS's regression tests. The project has been published on GitHub and sparked a lively discussion on Hacker News.
-
OpenMandriva Distribution Hit by Sabotage Attempt via GitHub
The OpenMandriva developers have reported an act of sabotage: part of the project's GitHub repository was deleted, and empty packages were pushed to the Cooker repository in an effort to crowd out GNOME and COSMIC.
- More