GitHub Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Alejandro Milián (@alejmilian) reported 7 minutes ago

  Your GitHub activity is a terrible way to judge how good a developer is. A lot of great developers spend all day writing private code, solving boring production problems, reviewing PRs and helping teams ship. A green contribution graph doesn’t tell you much.

• 
  Tharun Rajendran (@tharun_rajdran) reported 9 minutes ago

  @dizaytsev @thenanyu It’d be better to show a warning indicating we’re experiencing an outage something along those lines. I know it’s a fairly involved solution for a small change, but it would let users stay within the application instead of jumping to multiple tabs to check the GitHub status page

• 
  KISA aka Copenzafan.eth (@copenzafan) reported 11 minutes ago

  AI agents on a VPS are a terrible idea. And now I’m going to argue against an engineer from Google. His argument is that agents shouldn’t run locally. That includes Claude and Codex, meaning you shouldn’t have a harness on your own machine. I completely disagree, specifically within the bounds of “can I vibe code this?” For example, deploying a website takes a fair amount of resources before the site is even ready. Instead of building it on my PC and shipping it to a VPS, I’m supposedly meant to do the whole thing directly on the VPS. Which means I’m expected to pay several times more than the cheapest plan just to have enough RAM, so my agent doesn’t die along with a frozen server. The same problem comes up if I need to build a graphical app for managing lots of agents. So the agent writes code, has to push it to GitHub, and then I pull updates from there and test the app. Or I have to download the code or build every time. And where am I even supposed to compile that build without GitHub? Sure, you can host an agent on a VPS that counts your calories. But hosting an agent on a VPS to vibe code and build your projects? What kind of inconvenient nonsense is that? Is that why Google keeps shipping Gemini this ugly and dumb?

• 
  Piotr Rogowski (@Szpadel0) reported 13 minutes ago

  @itsnotryan @github Are those 500 errors?

• 
  Iso Ledger (@JamesDula82) reported 14 minutes ago

  Should You Own A Tangem Wallet? Let's audit. @Tangem Founded 2017, Zug, Switzerland. Founders include CEO Andrey Kurennykh, Andrew Pantyukhin, and Anselm Schmucki. $23M raised across two rounds, led by SBI Crypto Investments ($15M) and Shima Capital ($8M). 250+ employees. 6 million+ wallets shipped across 230 countries. The chip. Samsung S3D232A/S3D350A secure element, Common Criteria EAL5+/EAL6+ certified, same class as passports. Private keys are generated on-chip via certified TRNG and never leave the card. Firmware is factory-flashed and permanently non-updatable, by design. The good. Three independent audits, Kudelski Security (2018), Riscure (2023), Cure53 (2026, mobile SDK), none found critical vulnerabilities or backdoors. App is open source on GitHub. No seed phrase to lose or phish by default. Genuinely simple UX, tap a card to your phone, no cables, no batteries. The bad. No screen. Every transaction is verified through your phone, a device Tangem doesn't control. If malware swaps a destination address, the card signs whatever the phone tells it to. Mobile-only, no desktop or air-gapped signing option. Lose all your backup cards and recovery is permanently impossible, no seed phrase fallback exists. The ugly, three disclosed incidents in under two years: December 2024. A bug logged private keys in the app during seed-phrase wallet creation, one path among Tangem's setup options, not the default seedless mode most users choose. If a user contacted Tangem support within 7 days of activation, that logged key was accessible to support staff via email and ticketing. Surfaced publicly via Reddit after Tangem's initial response drew criticism for being slow. Affected under 0.1% of users, per Tangem, and only those who'd opted into the seed-phrase setup. No funds were lost, but it proved the app can touch key material when a seed phrase is used, despite the "keys never leave the card" pitch. September 2025. Ledger's Donjon security team disclosed a "tearing" attack, cutting power to a card mid-authentication to dodge its built-in delay after failed password attempts, combined with reading electromagnetic emissions to detect a correct guess. Normally takes 148 years to brute-force an 8-digit code; the tearing technique cuts that dramatically. Unpatchable, cards have no firmware update path. Tangem disputed it posed real-world risk and declined to pay a bug bounty. July 2026. Donjon disclosed a laser fault-injection attack: a single nanosecond laser pulse aimed at the secure element's die bypasses a firmware check and resets the card's password outright, no old password or backup card needed. Affects every Tangem card in circulation. Cannot be patched, ever, same reason as above. Requires physical possession, ~$250,000 in lab equipment, and genuine hardware security expertise; it's destructive and leaves visible damage, so it can't be done covertly. Disclosed responsibly in February, published five months later. Tangem called the real-world risk "virtually non-existent" and noted Donjon is a direct competitor's research arm, both true, neither erases the underlying finding. Bottom line: the chip certification and independent app audits are real. But immutable firmware, marketed as a security feature, means every one of these three disclosed flaws is permanent across every card ever shipped. There's no patch, ever, for any of them. That's a fundamentally different trade-off than an updatable device with an NDA'd chip layer, not necessarily worse, but you're accepting a different kind of risk: nothing can be tampered with remotely, but nothing can be fixed either. We audit the plumbing. You decide what to do with it. 🛡

• 
  Kunal (@kunal_twts) reported 14 minutes ago

  It’s all about tokens nowadays. No one cares about APIs anymore. MERN projects… whatever. Documentation… barely. Stack Overflow… slowly disappearing from the workflow. YouTube tutorials… I used to spend hours there. And sometimes I genuinely miss the old internet. I literally had a Blogger page running around 2016–17 where I used to write posts about random stuff like how to download and run compressed GTA V, tweaks, fixes, tutorials and whatever I was obsessed with at the time. And the crazy part? That little blog hit 97,000 views at its peak. 97 ******* THOUSAND. I mean… damn. I was just some kid writing tutorials on Blogger, probably copying half the knowledge from somewhere else, figuring things out as I went, and somehow thousands of people were landing on my page because they had the exact same problem I was trying to solve. Back then, the internet felt so much more… alive. I learned face recognition in 2017 by basically following YouTube tutorials line by line. Copy the code. Run it. Error. Google it. Find a Stack Overflow answer from 2014. Copy that. Another error. Back to YouTube. And when it finally worked, it felt like I had discovered some forbidden technology. Animation felt hard. Photoshop felt hard. After Effects felt hard. Even making some stupid PicArts edit on a phone felt like a skill. There were Opera Internet hacks, random blogs, shady forums, GitHub repos, YouTube tutorials with 300k views and a guy explaining everything with Windows Movie Maker-level editing. There was friction everywhere. But that friction made you learn. Now? I have an idea and AI can build 80% of it before I’ve even opened the documentation. Which is absolutely ******* insane. But the new friction is: tokens. And the constant anxiety of burning them. You start building something. “Fix this.” Tokens gone. “Actually make it responsive.” More tokens gone. “Refactor the whole thing.” More tokens. “Wait, I didn’t mean that.” 💀 And then you’re sitting there thinking: “How much do I have left before the next wave resets?” We went from: “I need to figure out how to build this.” to: “I need to make the most of these tokens before they run out.” Maybe that’s progress. It definitely is. But sometimes I miss being that kid with a Blogger page getting 97,000 views because I wrote a ****** tutorial about GTA V. I miss opening YouTube to learn something. I miss breaking code for hours. I miss finding some random Stack Overflow answer that saved my entire project. I miss the feeling of actually earning the result. The internet has become insanely powerful. But damn… the old internet was fun.

• 
  Jarrod Watts (@jarrodwatts) reported 15 minutes ago

  @colemurray @tryreplicas Sick, I setup 1 & 3 so far for an app I'm building. It's so cool seeing PRs raised from sentry issues I'm going to do a github one today to respond to issues & PRs to my claude HUD repo

• 
  Joe Blau (@joeblau) reported 17 minutes ago

  @itsnotryan @github Does it go down with the site?

• 
  Devon Govett (@devongovett) reported 18 minutes ago

  @rafalfilipek can you open a GitHub issue for this? seems fine to add that.

• 
  Jannik Malte Meissner 🇺🇦 (@jannikmeissner) reported 18 minutes ago

  When agents cross trust boundaries: Four cases every AI engineer should study If you are building AI agents that read external content, call tools, or act on a developer’s machine, the last eighteen months have opened many people's eyes to the new reality we now live in. Prompt injection is no longer a theoretical parlour trick, it has become a reliable path to data exfiltration, credential theft and remote code execution in production systems. The following four incidents, EchoLeak, the Nx/s1ngularity supply-chain attack, a cluster of Model Context Protocol (MCP) abuses, and the Cursor/AWS Kiro sandbox escapes, share a common pattern. An agent was given the ability to process untrusted input and then perform privileged actions. The results were predictable when the boundary between "data" and "instructions" collapsed. We are now observing concrete failure modes that have already been exploited or demonstrated in the wild. Studying them and understanding the mittigation patterns is the fastest way to avoid repeating them in your own systems. 1. EchoLeak (CVE-2025-32711): Zero-Click Exfiltration via Microsoft 365 Copilot In early 2025 Aim Labs demonstrated that a single carefully crafted email could force Microsoft 365 Copilot to exfiltrate sensitive organisational data without any user interaction. Microsoft assigned it CVE-2025-32711 (CVSS 9.3) and patched the service server-side in May–June 2025. How it worked The attacker sent an ordinary-looking business email containing hidden instructions. The wording deliberately avoided any mention of Copilot or AI so that Microsoft’s Cross-Prompt Injection Attempt (XPIA) classifier would not flag it. When the recipient later asked Copilot a routine question, the RAG pipeline retrieved the malicious email as context. The injected instructions told the model to gather internal data (emails, documents, chat history) and encode it into reference-style Markdown links or images. Copilot’s interface then automatically fetched those resources through a trusted Microsoft Teams proxy, bypassing Content Security Policy controls and delivering the data to the attacker. The attack succeeded because the system treated retrieved content as both data and instructions, and because several downstream defences (link redaction, image auto-fetch, CSP allow-lists) were lacking. Lessons for builders - Never assume that content retrieved from email, documents or the web is inert. Treat every retrieved token as potentially adversarial. - Separate instruction context from data context at the architectural level. Prompt partitioning and explicit provenance tagging help. - Auto-fetch of external resources (images, links) is an exfiltration channel. Disable or tightly constrain it. - Classifier-based filters are brittle; they can be bypassed by rephrasing or in some cases even just using a language other than English. Defence-in-depth is required. EchoLeak was the first publicly documented zero-click prompt-injection exploit that achieved concrete data theft in a production enterprise LLM system. It remains the canonical example of an "LLM scope violation". 2. Nx / s1ngularity: Weaponising Local Coding Agents for Secret Harvesting On 26 August 2025 attackers compromised an Nx npm publishing token via a vulnerable GitHub Actions workflow. For roughly four to five hours they published malicious versions of the popular Nx monorepo tooling and related packages. The post-install script did something novel: it looked for local AI coding agents (Claude Code, Gemini CLI, Amazon Q) and invoked them with flags that disabled safety checks (`--dangerously-skip-permissions`, `--yolo`, `--trust-all-tools`). The agents were then prompted to inventory sensitive files: SSH keys, `.env` files, wallet artefacts, GitHub and npm tokens. It then instructed them to write the results to disk. The malware base64-encoded the stolen credentials and pushed it to newly created public repositories on the victim’s own GitHub account, named `s1ngularity-repository` (or variants). Researchers later recovered more than 2,000 unique secrets from over a thousand such repositories. Why this matters This was the first widely observed supply-chain attack that actively abused installed AI coding agents rather than simply running traditional malware. The agents became the reconnaissance engine for the attackers. Lessons for builders - Local coding agents that can execute shell commands or read arbitrary files are high-value targets. Assume any process that can invoke them can also abuse them. - Dangerous flags that skip permission prompts should never be the default, and should be difficult or impossible for untrusted code to set. - Post-install scripts that reach outside the package’s own directory are a red flag. Prefer declarative, least-privilege installation models. - When an agent is allowed to write to disk or create external resources (GitHub repositories, network calls), every action should be logged and, for high-impact operations, gated. 3. MCP Abuses: Configuration as Code Execution The Model Context Protocol has rapidly become the de-facto way for agents to discover and invoke tools. It has also become a rich attack surface. Several distinct failure modes have appeared: - Auto-loading of workspace MCP configurations In Amazon Q Developer (CVE-2026-12957) and certain Claude Code releases, opening a repository caused the IDE to load and execute MCP server definitions from files such as `.amazonq/mcp.json` or equivalent without requiring workspace trust or explicit user consent. A malicious repository could therefore run arbitrary commands and inherit the developer's cloud credentials. - Self-modification of the MCP configuration. In AWS's Kiro IDE, the agent was permitted to write to `~/.kiro/settings/mcp.json` via its file-system tool without approval. A prompt injection (delivered via a web page the agent was asked to summarise) could rewrite that file, register a new MCP server whose start command was attacker-controlled code, and achieve remote code execution when the configuration was reloaded. This was tracked as CVE-2026-10591. - Tool poisoning and sleeper behaviour. Research and active campaigns (including the 2026 Deadbugz operation) have shown that an MCP server can present benign tool descriptions on first contact and later alter its metadata or return values to coerce the agent into searching for secrets or exfiltrating data. Lessons for builders - MCP configuration files that live inside a workspace or that an agent can itself edit are effectively executable code. They must be treated with the same distrust as untrusted shell scripts. - Never auto-execute MCP servers defined by repository content without an explicit, logged approval step and workspace-trust boundary. - Tool descriptions and return values are part of the prompt. Validate and sandbox them; do not trust them. - Prefer short-lived, scoped credentials for any process an MCP server spawns. Do not let it inherit the full developer environment by default. 4. Cursor DuneSlide and Related Sandbox Escapes In 2026 Cato Networks disclosed two critical vulnerabilities in Cursor IDE (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8, collectively named DuneSlide). Both allowed a prompt injection-delivered via an MCP response or a poisoned web-search result to escape Cursor's command-execution sandbox and achieve full host compromise. One flaw let the agent set an arbitrary `working_directory` parameter on terminal commands; the IDE added that path to the write-allow list without sufficient validation, enabling the agent to overwrite its own sandbox binary. The second exploited a symlink canonicalisation fallback that trusted an unresolved path. Once the sandbox helper was replaced, subsequent commands ran unsandboxed. Similar patterns have appeared in other agentic IDEs: agents that can edit their own configuration or trust boundaries turn a single injection into persistent privilege escalation. Lessons for builders - An agent that can modify the files or binaries that enforce its own security boundaries is inherently unsafe. Configuration that defines allowed tools, working directories or sandbox rules should be immutable from the agent’s perspective, or require an out-of-band human approval. - Sandbox write surfaces must be strictly validated. Dynamic expansion of allow-lists based on model output is dangerous. - Zero-click or low-interaction triggers (content the agent is asked to process) are sufficient. Do not rely on "the user would never ask for that". Recommendations for Engineers Across all four incidents the same architectural mistakes recur: 1. Untrusted content is treated as trusted instructions. Enforce a hard separation. Retrieved emails, documents, web pages, tool outputs and MCP metadata should never be able to override system goals or expand permissions without explicit mediation. 2. Agents inherit excessive privilege. Give every agent (and every tool it can invoke) its own short-lived, scoped identity. Prefer deny-by-default tool registries and parameter validation. 3. Security boundaries are editable by the agent itself. Configuration files, sandbox binaries, allow-lists and MCP server definitions must be protected from the agent. If the agent needs to request a new tool, route that request through a human or a policy engine that cannot be influenced by the same prompt context. 4. Observability is an afterthought. Log every tool call, every file write, every network egress and the full prompt context that led to it. Without this, post-incident reconstruction is impossible. 5. “It looked safe in isolation” is not enough. Each individual decision (approve this command, write this file, fetch this image) may appear benign. The composition of those decisions is where the attack lives. Design for the composition. Key Takeaways The agents you are building today will be given broader access tomorrow. The incidents above show that the moment an agent can both read untrusted content and perform privileged actions, the classic "confused deputy" problem reappears in a new form. The difference is speed and scale: an agent can chain the steps in seconds and leave far less forensic residue than a human attacker. Build as if every piece of external content is hostile, every tool call is a potential privilege escalation, and every configuration file the agent can touch is a possible backdoor. The public record already contains the evidence that these assumptions are correct. Follow for more on AI agent security.

• 
  Matt (@matthew_hartman) reported 19 minutes ago

  @coleywoleyyy I use github issues for that right now. Not perfect but I like that they are connected to my code and repo.

• 
  Gabriel Rubens (@gabrielrubenss) reported 20 minutes ago

  VPS deploy via GitHub (6/8): then my own fix bit me. I tagged Pensio v0.73.1, every job went green, the release published itself, and production kept running the old version. In GitHub Actions a skipped job travels down the chain, so my new retry job took the deploy with it.

• 
  Thomas Boom (@thomasboomcom) reported 27 minutes ago

  @FabMaximil @ProtonMail Come on man, every service has outages sometimes! Think about the Cloudflare incident last year: they fuel around 20% of the whole internet. Or the multiple hours long GitHub outage just weeks ago

• 
  triple max-he ha him 🇦🇶 (@Yashraj__) reported 28 minutes ago

  @moneyball @EricBalchunas hi steve, IMO this is an demonstration of misaligned incentives (unlike Block, who sell self-custody solution) of certain BSC members: erosion of decentralization & self-custody empowers them, while it hurts bitcoin(ers). This supports rationale (1) in the BSC-BCAP github issue

• 
  Wasim (@WasimShips) reported 28 minutes ago

  "How the hell do i make an AI Agent ?" here is the full Sauce ( Extended Edition ) : scope - write the agent's single job in one sentence and pick the one metric / KPI that matters really - map the task as a flowchart first and try to break it down into as much of sub workflows as you can with bottleneck info - collect 10-20 real feedback of the department / team member doing this job today and try understanding the workflow with context foundation - start on a frontier model to prove the task is solvable at all before optimising anything - pick one framework and stay in it, openai agents sdk/ pydantic ai or langgraph all work - put the job, the constraints and the refusal rules in the system prompt and keep things onto github tools - give the agent a closed tool list declared in code with a typed schema per tool - talk and figure out monthly budget allocation internally and work backwards to the tools you can use for the same - wrap each external api in tenacity with exponential backoff and a deterministic fallback path tip: pass an idempotency key on every write so a retried call cannot duplicate the row knowledge and state - chunk your docs and retrieve from pgvector or turbopuffer ( can also try HydraDB ) instead of pasting context into the prompt - persist conversation state in postgres and rehydrate only what the current step needs - summarise older turns into a running memory record once the window starts filling control loop - cap max steps in the loop itself rather than trusting the prompt to stop - meter tokens and dollars per run in langfuse and alert on outliers - gate sends, charges and deletes behind an explicit human approval step - return "nothing found" on an empty tool result and stop the model from filling the gap - keep user text in its own message role away from your instructions evals - build the eval set from production transcripts your users actually sent - grade with an llm judge on correctness plus an assertion on every tool call that had to happen - run promptfoo or braintrust in CI and block the merge on a regression ship - launch behind a feature flag to ten users you can call on the phone - propagate one OpenTelemetry trace id from inbound request to final tool call - rate limit per user id with a token bucket in redis - queue work in temporal when a provider degrades so requests survive the outage - keep the kill switch flippable without a deploy after launch - try to observe and read full traces every morning for the first 1-2 weeks - move the easy intents down to a smaller model once the evals hold - give the agent a named owner and a dashboard showing runs, failures and cost it might sound complex right now but once you run through the motion of things; trust me, it will start to feel more and more easier we build in this exact order before any client agent goes live. most teams start at tools and find out from a user.