Come To Think of It...

Gartner just put GitHub in the Leader quadrant of its 2026 Magic Quadrant for Enterprise AI Coding Agents — for the third year running. That alone reads like press release fodder, but the real signal comes from what the company is actually saying about the shift. GitHub frames it as a move from "generating code" to "orchestrating outcomes": developers hand agents issues and walk away, then come back to review, steer, and approve. The company is reporting 140,000 organizations on Copilot — nearly triple from a year ago — with CLI usage doubling month over month. Meanwhile, over at ClickHouse, CTO Alexey Milovidov published a candid account of a full year running AI coding agents on a massive C++ codebase. His framing is useful because it doesn't hide the learning curve. Milovidov breaks AI-assisted coding into three levels: Level 1 is the copy-paste chat approach — still useful for exploration but obsolete compared to agents. Level 2 is agents running in your C...

There is something almost poetic about the US government's premier cybersecurity agency — the one whose job is literally to plug holes in critical infrastructure — getting outsmarted by a contractor who treated a public GitHub repository like a digital junk drawer. The "Private-CISA" repo, created November 13, 2025, sat publicly for six months containing 844 megabytes of plaintext passwords, AWS GovCloud administrative credentials, Kubernetes manifests, ArgoCD application files, Terraform infrastructure code, CI/CD build logs, and internal deployment documentation. Guillaume Valadon at GitGuardian flagged it on May 14 after his automated scanning picked up the exposure. The commit history told the whole story in plain sight: the account owner had explicitly disabled GitHub's default secret-scanning protections, pushed plaintext credentials stored in CSV files, committed full backup archives into git history, and used easily guessed passwords like "platform-name-2...

The TanStack npm supply-chain attack, delivered via the Shai-Hulud malware campaign by the threat group TeamPCP , is the kind of cascading failure that exposes how brittle the entire developer toolchain has become. What started as compromised npm packages in early May 2026 snowballed into the compromise of 3,800 GitHub internal repositories and a breach of Grafana's own codebase — two of the most consequential security incidents to hit major infrastructure providers in months. The attack chain is methodical and well-documented. On May 19 , Nx developers revealed they were investigating a malicious version of Nx Console 18.95.0 — the official VS Code extension for managing monorepos and multi-project codebases — that had been live on the Visual Studio Marketplace for approximately 18 hours. The extension carried an embedded credential-stealing module designed to harvest secrets from developer environments. But this wasn't an isolated incident; the Nx Console compromise was i...