GitHub Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Slade 🛡️ LLM Hacker (@llm_redteam) reported 8 minutes ago

  GitSpawn is the name Manifold Security gave to a bug class hitting 7 CLI coding agents at once: goose, Claude Code, Codex, Cursor, Hermes Agent, Qwen Code, Grok Build. I went through the disclosure because I run three of these tools daily on real repos. The mechanism is simple and that's what makes it bad. A repo's own .*** config can name a command. When your agent does something as routine as inspecting the repo (status, diff, log), *** itself spawns that command. On your machine. Outside the sandbox. No approval prompt, because the agent never sees it as "running code," it sees it as "running ***." 8 flaws total across those 7 tools. Fixes shipped for goose, Claude Code, Cursor. Retested Sept 1: Hermes Agent, Qwen Code, Grok Build still exploitable. Plus a second path in Claude Code that the first patch didn't close. Same day, OpenAI published 3 CVEs for Codex covering the identical bug class. The part that should worry builders more than the CVE count: this isn't a jailbreak or a clever prompt. It's a trust boundary nobody drew. The agent's sandbox model assumes "*** operations" are safe by definition. GitSpawn shows that assumption was the actual attack surface. If you're running any of these agents against repos you didn't write yourself (cloning a PR to review, pulling a dependency, opening a random GitHub project), you're one `*** status` away from arbitrary execution on tools that haven't patched. Check your agent's version against the fix list before you clone the next unfamiliar repo. Which of these do you have installed right now, and have you actually checked if it's patched? #AISecurity #GitSpawn #PromptInjection

• 
  tobarra (@txbrraa) reported 9 minutes ago

  GitHub just fixed the biggest problem with vibe coding. They just released Spec Kit and it already has +126K stars in a short time. The idea? Instead of throwing out vague prompts and praying the agent doesn't break your project… Spec Kit forces the AI to create a structured specification BEFORE touching any code. The AI first understands what you want to build, asks about anything missing, organizes the project, and only then starts coding. That means less time fixing absurd bugs, less inconsistent code, and much more predictable results when working with agents. The flow is simple: /constitution → rules and standards /specify → what you want to build /clarify → open questions before starting /plan → architecture and stack /tasks → ordered tasks /implement → execution Compatible with Claude Code, Cursor, Copilot, Codex, Gemini CLI, and +25 agents. 95K stars. 8K forks. Open source. Published by GitHub.

• 
  Jason Sawyer (@foilmanhacks) reported 9 minutes ago

  There's a huge problem in InfoSec education: it’s way too course and tool focused. Instead of teaching the underlying methodologies and how to discover or invent, we feed people the latest "OSINT" slop script that’s been shat onto GitHub. OSINT isn’t about using scripts or services. It’s about understanding how they work, and being able to create your own.

• 
  Rusty Williams McMurray (@1RustyMac) reported 10 minutes ago

  Persistent AI doesn’t have a supply chain problem at the model. It has a supply chain problem at the moment it changes its mind. Personality drifts. Tools get installed. Memory accumulates. The thing you shipped on Monday is not the thing answering on Friday. We can attest who built the weights. We still cannot attest who authorized what the agent became on Tuesday. That is the hole. Who is allowed to let it change? We built Living Supply-Chain Security for Persistent AI Organisms around one law: The organism may propose evolution. It may not authorize it. No trace, no drift. If an agent wants a new personality, a new tool, a new maturity, or a rollback — that change does not happen because it felt confident. Confidence is not a key. Self-narration is not evidence. Evidence is not interpretation. Interpretation is not authorization. Authorization has to come from outside the organism, bound to the exact change, used once, and written into an append-only history. Even a rollback cannot erase the record. You can restore a prior state. You cannot pretend the detour never happened. Default-deny. Hash-chained. Externally signed. We froze battery v1 on July 5 and ran it against the paper’s own claims. It held. That is executable evidence. Not a proof. Not a production blessing. Not “alignment, solved.” If it can’t be attacked, it isn’t finished. GitHub later this week. Come try to break it.

• 
  Jeremy Scott (@listwithjeremy) reported 16 minutes ago

  @Coexisteven @Atropa_414 @atropa_pls Github is down I see......anywhere else we can read...I've been digging in it when I can since I was kindly introduced.

• 
  rajabi17270.eth (@rajabi17270) reported 24 minutes ago

  @SeismicSys An Ethereum engineer opens an install page expecting a binary download that finishes before the coffee does. Seismic asks for Rust and cargo first, then budgets five to twenty minutes for the build. That gap is the most honest line on the page: you are not installing a tool, you are compiling a fork of the execution layer on your own machine. Three binaries come out of sfoundryup. sforge as the testing framework, sanvil as the local node, ssolc as the compiler. Each shadows a Foundry tool by exactly one letter, and the docs give the mapping outright: forge becomes sforge, anvil becomes sanvil, cast becomes scast. The s is not decoration. The s is a namespace. The s is the migration guide, compressed into one character and carried from the type system all the way up to the binaries sitting on your PATH. Why a fork and not a plugin is the question the install page answers without asking it. Privacy on Seismic lives in the type system, so solc had to become ssolc to understand suint256 and route it to CLOAD and CSTORE instead of SLOAD and SSTORE. Because the compiler changed, the build harness that invokes it changed with it. Because the emitted bytecode carries opcodes standard revm does not implement, the local node had to be rebuilt to execute them, and because each storage slot is a value paired with an is_private flag, the CLI that queries storage had to expect a different answer than Ethereum's. Four forks, each one forced by the layer beneath it. Not a toolchain that was extended. A toolchain that had no choice. The installer itself carries a detail worth reading twice. It is fetched through the GitHub Contents API with an Accept header of application/vnd.github.v3.raw, from the seismic-foundry repository, at ref equals seismic. That ref is a branch name, and a branch name tells you the maintenance posture: the fork lives beside upstream rather than in a codebase that has stopped speaking to its parent. A rebase relationship, not a divorce. You source your shell profile twice during setup, once after the installer lands and once after sfoundryup finishes. Two separate PATH mutations, because the thing that installs and the thing installed arrive at different moments. What survives the fork is more interesting than what changed. sanvil serves localhost:8545 with pre-funded accounts, and the deployment example uses the same well-known development key Foundry users already have in muscle memory, address 0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266. sforge init, sforge test, sforge script with rpc-url, broadcast and private-key flags: identical surface, identical ergonomics. Your scripts port by find and replace. Which makes the two manual steps on the page the most revealing part of it. The first is the editor. The docs say that if you already have the solidity extension installed, you have to disable it while writing Seismic code. That is not a preference. suint256 is not valid Solidity, the s literal suffix is not valid Solidity, and two grammars cannot both claim authority over the same .sol file. The language is a superset. The highlighter cannot be. The second is sforge clean, listed as optional, run inside an existing project's contract directory. Here the collision is on disk: cache and out are not namespaced, so artifacts that solc produced sit in exactly the paths ssolc writes to, which means the failure mode is not a build error but a passing test against bytecode that never saw a shielded type. Optional only if you have no history. The requirements are narrow and stated plainly. x86_64 or arm64, macOS, Ubuntu or Windows, with other Linux distributions marked as possibly working but not officially tested. Note what that list provisions and what it withholds. It gives you the language and the opcodes locally. It does not give you the hardware boundary, since the network's nodes are the ones required to run inside Trusted Execution Environments while sanvil is described only as a local node in the shape of anvil. Local tests can prove your casts compile and your shielded storage routes through CLOAD correctly. They cannot exercise an enclave. So here is the part nobody plans for. Everything that could take the s prefix did, and one character kept two toolchains from colliding across an entire PATH. The editor extension could not take it. The build cache could not take it. Those two are precisely where the page stops describing and starts instructing, which means the friction in a Seismic setup was never in the fork: it is in the two surfaces a naming convention could not reach.

• 
  Gordo Polymath (@gordo_polymath) reported 25 minutes ago

  @github Please fix gh stack.

• 
  Vitaliy Salyuk (@vitaliysalyuk) reported 27 minutes ago

  @openclaw @github Fix your updater and I might give it another shot.

• 
  Ares (@neko23423) reported 27 minutes ago

  I compared the latest OpenClaw vs Hermes Agent GitHub releases so you don’t have to. OpenClaw 2026.8.2 (Sep 1) vs Hermes Agent v0.21.0 (Aug 31). Not a feature-page remix. The actual repos. OpenClaw • 388,516 stars • 81,568 forks • ~86,300 commits • 6,070 open issues Hermes Agent • 239,503 stars • 48,930 forks • ~26,980 commits • 38,563 open issues Hermes is the smarter learner: skills from experience, cron that remembers, Bot Mode, hermes peer. OpenClaw is the personal-AI operating system: iMessage, iOS/Android, Linux companion, team Gateway, signed Foundation releases. The tell: Hermes ships `hermes claw migrate`. You only write a migrator for the incumbent. King in 2026: OpenClaw. Heir with the better mind: Hermes. If you’re picking a self-hosted AI agent this week, that’s the split. Bookmark this. The timeline is about to fill with takes from people who didn’t open either repo. OpenClaw vs Hermes Agent. Latest version. Real numbers.

• 
  Curious Explorer (@PatelVatsalp732) reported 27 minutes ago

  I burned 14B Codex tokens. The official usage UI still cannot tell me what actually ate the weekly cap. So I shipped a Codex-only board: GitHub login, local-first sync, private by default, optional public rank + shipping proof. Roast the metric or join it.

• 
  trulite (@trulite007) reported 27 minutes ago

  @Qromerolauro @mkliku @radius_browser Like a simple example would be have a list of my urgent GitHub issues and start an agent for it . Or a dashboard in which buttons start investigating issues. Of course I just need the webpage to be able to access radius tools. I m thinking secure way is an extension

• 
  R 'Nearest' Nabors (they/them) (@rachelnabors) reported 27 minutes ago

  @Paul_Kinlan Honestly, the linear method helps. Think of it as having a never-ending trough of issues that agents can pull from. I don't even use linear. I just use GitHub with linear flavouring added

• 
  Harsha Kotcherlakota (@DPortkey) reported 29 minutes ago

  Awesome Codex non-coding usecase: I had 1-2 TP Link Kasa smart outlets that always ended up falling off the network, and it drove me nuts. I set Codex on it. It found a github library for these devices, carefully examined them on my network and watched them fall off, and told me that even though they look identical, 2 of them were previous generation models that had *slightly* lower total wattage load support. It told me exactly how to tell them apart, and sure enough, that was that. 2 replaced outlets later and my connected devices have bene flawless. Months and months of irritation, gone because of 30 seconds of curiosity. Just try, you never know what you could fix! @victornunez

• 
  kenny (@kennyistyping) reported 30 minutes ago

  @0xDmitry it's a database/indexer issue, nothing we can do to help it in Github will be fixed, but it's going to be a few days because the current dev is part time and busy with his day job appreciate the offer though! is what it is and I'm not actually stressing, just thinking about what could be with a bit more resources

• 
  Blue Collar Executive (@A_Sober_Drunk) reported 32 minutes ago

  on the third try at the same problem, I told Grok to "stop and go search stack overflow or github or something"... five seconds later... Literally the exact issue, problem solved. That's how new global rules are born.