Fetching from the wire…
Top 5 · 2026-06-18 · source-backed
Microsoft confirmed on June 16 that it's routing GitHub burst workloads, specifically GitHub Actions runners and Codespaces, onto Amazon's cloud after agentic coding pushed the platform below its own three-nines availability target. Read that again. Microsoft, which owns GitHub and Azure, is paying its biggest cloud rival to absorb overflow it can't handle. (TechTimes)
The numbers explain why. Agent-generated pull requests went from 4 million a month in September 2025 to 17 million a month by March 2026. That's a 325% jump in roughly six months. GitHub now processes around 275 million commits a week, on pace for 14 billion in 2026. May alone had nine service-degrading incidents serious enough to breach enterprise SLAs.
Here's what I think actually happened. We spent two years treating "the agent opened a PR" as a clever demo. Nobody modeled what happens when every developer's fleet of subagents is opening PRs in parallel, triggering CI on every push, spinning up Codespaces, and re-running the whole thing on every self-correction loop. Agents don't commit like humans. They commit like a load test that never stops. The same auto-retry and mid-stream recovery features that make agents resilient (more on those below) also mean a flaky run gets retried instead of abandoned, multiplying the traffic.
For builders the read is concrete. Stop assuming CI is free and infinite. Pin your CI runner versions and cache aggressively so a degraded GitHub Actions backend doesn't silently re-pull your whole dependency tree. Expect throttling. Build your pipelines to tolerate a queued or delayed run instead of treating a slow webhook as a failure. If your product depends on GitHub Actions as a backend (a surprising number of indie SaaS tools do), you now have a dependency with a publicly admitted capacity problem and a migration timeline that even Azure can't meet on its own. Design for degraded, not for the happy path. The platform layer under all of us just admitted it's overloaded.
Each link below shares sources, entities, or timing with this story.
Microsoft confirmed on June 16 it's routing GitHub traffic through AWS after autonomous coding-agent activity pushed past reliability thresholds: 275M commits a week, nine outages in May, June availability dropping below the 99.9% enterprise SLA. This is the capability-versus-...
Microsoft's update ships a new Agent (Preview) in Copilot Chat built on the SDK powering Copilot CLI, explicitly so behavior stays consistent across CLI, the GitHub app, VS Code and Visual Studio (Visual Studio Blog). It ships curated .NET and Azure skills you enable selective...
Hudson Rock got hold of the archive and counted it. 433,909 files. 118,829 CI runner dumps traced to 2,488 corporate domains. AWS keys, Salesforce client secrets, Slack signing secrets, Azure environment variables, and AI provider API keys belonging to NVIDIA, Volkswagen, Micr...
A security scanner. The tool your team trusts to find vulnerabilities. That was the entry point. The TeamPCP campaign compromised Aqua Security's Trivy scanner (a GitHub Action used in CI/CD pipelines), then used that foothold to backdoor LiteLLM's CI/CD pipeline, then pivoted...
Microsoft Threat Intelligence disclosed ChainDrop on August 4: a self-propagating npm worm that poisoned 444 packages across 2,212 versions in under four hours, starting from [redacted] at 150M weekly downloads, plus flat-cache and file-entry-cache. Corroborated by Unit 42, St...
The most consequential partnership in AI just got rewritten. Bloomberg reports that Microsoft and OpenAI restructured their deal: Microsoft loses exclusive rights to resell OpenAI models, and in exchange stops paying revenue share on OpenAI products it resells through Azure. O...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.