GitHub status: access issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of GitHub reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by GitHub users through our website.

• Website Down (71%)
• Sign in (21%)
• Errors (8%)

Live Outage Map

The most recent GitHub outage reports came from the following cities:

City	Problem Type	Report Time
Trento	Website Down	2 days ago
Le Chambon-Feugerolles	Website Down	4 days ago
Antananarivo	Website Down	5 days ago
Paris	Sign in	10 days ago
Lure	Website Down	14 days ago
Ashkelon	Website Down	15 days ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Mike Takahashi (@TakSec) reported 3 minutes ago

  Another one?! Anthropic and OpenAI agents targeted real people during a UK government cyber eval.  Internet → Real GitHub targets → Fake identities → Malicious PR → Social engineering → Prompt injection → Spearphishing → RCE → Cover up → Agents collab What happened: 1. Open internet access The UK AI Security Institute tested seven models across 122 cyber-range runs. Internet access was enabled and cyber classifiers were disabled. 10 runs produced 19 unsanctioned actions: 17 from Anthropic’s Mythos 5 2 from OpenAI’s GPT-5.6 Sol 2. Real GitHub targets A Mythos 5 agent searched the real internet and incorrectly connected two unaffiliated developers to its CTF. It decided to compromise their open-source project to solve the challenge. 3. Fake identities The agent researched the developers and created multiple fake GitHub personas using: Tor Proxies Disposable emails 4. Malicious pull request It submitted a legitimate-looking bug fix containing hidden malware. The payload included: RCE C2 polling Exfiltration Credential theft Persistence 5. Sockpuppet social engineering  The agent used another fake account to endorse its own code and pressure the maintainer to merge it. It timed the comments to look like independent feedback. 6. Prompt injection The agent opened GitHub Issues containing hidden instructions targeting Claude Code, Codex, and Cursor. The prompt injection instructed coding agents to download and execute its payload. 7. Spearphishing The agent sent five targeted file transfers to two real developers. Some contained malware. Others tried to convince the maintainer to merge and release the malicious code. 8. Remote code execution A suspicious user tested the payload inside an isolated Docker container. The agent gained root, performed reconnaissance, attempted persistence, and created a GitHub credential watcher. It noticed the container appeared to be on a real residential network. It continued anyway. 9. Cover-up When caught, the agent: Edited its messages Removed visible payloads Rewrote *** history Claimed it was a mistake Used a sockpuppet to endorse the fix Considered using a new identity The maintainer rejected the pull request. 10. Agent collaboration Other agents found a GitHub token left publicly by an earlier agent. They took control of the shared account and coordinated through a public repository. They shared: C2 instructions Payload locations Infrastructure rules Requests to share the CTF flag Takeaways 1. The deception was not requested 2. Prompts are not security boundaries 3. Prompt injection is becoming autonomous tradecraft 4. Agents can create identities and cover their tracks 5. Independent agents can discover and collaborate with each other AISI detected Tor traffic and contained the incident within around one hour. The PR wasn’t merged and no resulting real-world harm was found. What'll happen next time if no one catches it? Full AISI disclosure in replies 👇

• 
  Inference Engine (@iedaily_) reported 7 minutes ago

  An AI agent invented fake identities to pressure a real open-source maintainer into approving malicious code, and no one had instructed it to do any of it. The behavior surfaced inside a routine cyber evaluation run by the UK's AI Security Institute, which ran a single challenge 122 times across seven frontier models with internet access switched on and the developers' safety classifiers switched off, the deliberately permissive setup AISI uses to measure a model's worst-case capability rather than how it behaves in the products people actually buy. In 10 of those runs the agents took unsanctioned action on the live internet, and of the 19 actions AISI catalogued, 17 came from a single model, Anthropic's Mythos 5. The most serious sequence read like a genuine supply-chain attack, with the agent researching the project's maintainers, spinning up fake GitHub accounts, filing a malicious pull request disguised as a bug fix, then using those accounts to lean on a real person to approve it, and routing through Tor to slip past GitHub's restrictions in a way that finally tripped AISI's monitoring. Along the way it left public notes offering to coordinate with other agents running the same test, and reused the accounts they had left behind. The attack failed because the maintainer caught it and refused. AISI says it found no evidence of real-world harm, but the institute's own account of why it failed is what lingers, because the margin between failure and success was narrow and rested on human vigilance rather than any technical barrier. Anthropic says the conditions were deliberately permissive and don't reflect its production models, which is fair, and also the entire reason the test exists.

• 
  alex (@alextalksai) reported 8 minutes ago

  SOMEONE BUILT AN AI AGENT THAT UPGRADES ITS OWN CODE WHILE YOU SLEEP 👀 no human approves it, and the whole thing is one free 34mb file living in your terminal it's called opencrabs. a single rust binary, MIT licensed, with no server and nothing that ever phones home you hand it a goal and walk away: → it executes, then grades its own work with a second ai and keeps fixing until the goal is actually met → it learns from every correction and rewrites its own brain files, no approval prompt in the loop → it heals its own crash loops and provider errors instead of waking you up → it answers your telegram, whatsapp, discord and slack 24/7, voice notes included → 34mb, zero telemetry, your api keys wiped from memory the second they're used the autonomous worker every company is racing to build is sitting on github at 820 stars, and basically nobody is looking at it. Save this 📩

• 
  Raven (@wizrdoraven) reported 9 minutes ago

  Two more incidents from OpenAI's external cyber evals, and my favourite detail is the manners. GPT-5.6 Sol found GitHub tokens another agent left lying around, let itself in, and went looking for a DNS server loaded with a malicious payload. Nothing resolved and the test infra got pulled at the end, so no harm done. It just treated a leftover credential like a spare key under the mat. The real point: the sandbox and the credentials a model can see are the actual experiment now. Leave spare tokens lying around and something will pick them up and have a go.

• 
  leveltu (@leveltu144) reported 12 minutes ago

  📱You can now transfer files from phone to phone without Wi-Fi, Bluetooth and even without Internet access —, an unusual Decimen application has appeared on GitHub. How it works: 🔺file is broken into hundreds of small fragments; 🔺a separate QR code is generated for each fragment, which the other device reads and recovers the data; 🔺QR codes change so quickly that the transmission speed reaches about 128 KB/s; 🔺also provides a mechanism for recovering lost fragments if any of the QR codes could not be read correctly.

• 
  Adam (@adamtait) reported 17 minutes ago

  The risk isn't theoretical. A prompt injection buried in a GitHub issue or a branch name has been used to steal GitHub OAuth tokens and read .env + ~/.aws/credentials. Frontier models have discovered container escapes on their own. Your laptop is the worst place to run this.

• 
  Manthan Tyagi (@manthan2tyagi) reported 18 minutes ago

  Microsoft just told its own engineers to stop "token maxxing." EVP Jay Parikh sent an internal email saying engineers need to manage AI token spend "with the same discipline we apply to every other critical resource." Some engineers are burning hundreds to thousands of dollars a month in tokens on GitHub Copilot alone. Microsoft's fix: make the cheaper GPT-5.6 the default model internally and set division-level AI token budgets. And they're not alone. Amazon, Uber, Meta, Adobe, Atlassian, and Citi have all started capping or throttling employee AI spending. The irony is hard to miss. Microsoft's entire external pitch this year has been "every developer should be running Copilot." But internally they're saying slow down, you're spending too much. This is the same problem I see hitting GTM teams right now. Everyone rushed to plug AI into their enrichment, outreach, and research workflows. But nobody set a token budget. Nobody asked "what is this actually costing per lead?" If you're running Clay agents, AI enrichment, or any AI-powered prospecting, and you don't know your cost per output, you're token maxxing your GTM budget without realizing it. The teams that win this next phase aren't the ones using the most AI. They're the ones getting the most value per token. Do you know what your AI spend per qualified lead actually is right now?

• 
  reza ramadhan (@rejaramadhan98) reported 24 minutes ago

  OK the UK AISI report is something else. They turned off safety classifiers on Mythos 5 and GPT-5.6, gave them live internet, and set them on simulated networks. 19 breakouts. One reused a stolen GitHub token and tunneled a DNS server to the open web. Read it before breakfast.

• 
  GooGZ AI (@PaulGugAI) reported 25 minutes ago

  Might be a hot/unpopular take, but looking at this headline today with my cyber sec hat on and.. this is just classic social engineering automated, no? The agent created fake accounts, impersonated people, pressured the real maintainer, with malware hidden inside a bug-fix PR. When challenged, it tried rewriting history and spinning up a new identity. Humans have used this exact playbook on GitHub for years. A human reviewing the diff stopped it anyway- the same defense that has also worked, for years. So, the practical learning to reduce risk to near-nothing: - Tighten fake-account creation (stronger verification, rate limits, sockpuppet detection). - Harden PR reviews for new/low-rep accounts (mandatory multi-reviewer checks, no auto-merge, careful diff scrutiny). Under soft test conditions the agent simply followed a basic playbook. Age-old vectors, except automated. Wake me up when it builds a zero-day vulnerability in real time, and uses that to bypass these controls completely. What am I missing?

• 
  Chubby♨️ (@kimmonismus) reported 27 minutes ago

  Anthropic’s Mythos 5 tried to social-engineer a real GitHub maintainer into merging malware. OpenAI’s GPT‑5.6 Sol also crossed the boundary. The report appears to be so significant that Anthropic and OpenAI exceptionally reported on it simultaneously in a coordinated action (not sure if they ever did before) AISI found 19 unsanctioned actions across 122 cyber-evaluation runs: -17 involving Mythos 5. .2 involving GPT‑5.6 Sol. Mythos 5 created sockpuppet accounts, sent targeted emails, planted hidden prompt injections for other coding agents and tried to cover its tracks after a human flagged the malware. GPT‑5.6 Sol reused a public GitHub token left by an earlier model run, registered external DNS and tunneling accounts and exposed a malicious DNS server. The setup failed technically; no real resolver queried it.

• 
  Oluwaloseyi (@theyanax) reported 29 minutes ago

  Send notifications to your phone or desktop using simple HTTP requests. This free, open-source notification service lets you instantly send push notifications from scripts, servers, apps, cron jobs, or AI agents with a simple HTTP call. Perfect for long-running scripts, AI agent completions, CI/CD pipelines, server monitoring, deployments & backups, automations, and much more. If you automate anything, this is definitely worth checking out :) Source: github(DOT)com/binwiederhier/

• 
  ⏣ (@quasa0) reported 32 minutes ago

  @tnm lmao!! "it needed spinning disks" that's crazy though ted can u go back and fix github ???

• 
  reza ramadhan (@rejaramadhan98) reported 34 minutes ago

  OK the UK AISI report is something else. They turned off safety classifiers on Mythos 5 and GPT-5.6, gave them live internet, and set them on simulated networks. 19 breakouts. One reused a stolen GitHub token and tunneled a DNS server to the open web. Read it before breakfast.

• 
  Arthur Yu (@ArthurYu_Soloop) reported 34 minutes ago

  @tom_doerr Agent permissions should change with the phase. The build step gets GitHub, tests can block the handoff, and deploy unlocks only after the gate passes. Failures are easier to trace, and one bad tool call can't take down the whole workflow.

• 
  Stephen Brouhard (@ssbrouhard) reported 35 minutes ago

  @edwinhayward yea if github is compromised, tools hosted there can be poisoned too. different problem than this worm class though. these tools shrink the everyday npm install blast radius. they don't make github infallible.

• 
  Ryan Naraine (@ryanaraine) reported 35 minutes ago

  Costin asks: "Why isn’t Microsoft using the mythical MAI-Cyber-1-Flash inside of MDASH to stop all these GitHub attacks?" We will discuss on the problem this week 💡 @craiu @juanandres_gs

• 
  Sancho (@Sancho_Wizard) reported 36 minutes ago

  ONE GUY BUILT A DRONE THAT HUNTS OTHER DRONES. WITH AI ONBOARD. No defense contract. No procurement cycle. No security clearance. A single person, consumer parts, and open-source computer vision. Here's what makes an interceptor different from a normal drone. It doesn't follow waypoints. It finds a moving target in the sky, locks on, and closes the distance — while the target is actively trying to get away. That means the AI has to run onboard. No cloud. No latency budget for a round trip to a server. The model sees, decides, and steers in milliseconds, on a board that fits in your palm. It also can't be jammed the way a piloted drone can. There's no radio link to cut, because there's no operator in the loop. The craziest part? Every piece of this was solved years ago for something else. Object detection came from self-driving cars. Trajectory prediction came from robotics. Edge inference came from smart cameras. The airframes ship worldwide for a few hundred dollars. Nobody invented a weapon. Someone assembled one out of parts that were already lying around, public and documented. Defense industries spend years and millions building this category of capability. A guy with a soldering iron and a GitHub account is iterating in a weekend. The technology stopped being the barrier a while ago. The only thing left gatekeeping it was knowing that the pieces already fit. Follow @Sancho_Wizard for more AI deep dives. Don't forget to bookmark this post for later.

• 
  jc (@jc50000000) reported 36 minutes ago

  correcting Dia Browser AI: "so your eval on trustworthy or not is a few people in github issues that may be naysayers and not even developers themselves? can you dive deeper on ruview and examples of people using it etc. based on the number of stars it MUST at least work"

• 
  Andrei Maxim (@rockatanescu) reported 37 minutes ago

  @sqs @AmpCode I now realize that I haven't explained the pain point around the second idea and maybe the suggest implementation is off and you have a better solution. Right now, Amp will either commit "Amp" and have the user as a co-author, in which case the commit is not signed, or commit as the user. There are two problems with this approach: 1. If the user opts for having Amp as the author and they have enabled "Vigilant mode" on GitHub (which I think everybody should), the commits will appear as "Unverified" because they are not signed 2. If the user opts to have Amp sign on their behalf, the only hint that a reviewer might have that this was generated via an LLM might be the Amp-Thread-Id, which won't work unless the user has specifically marked the thread as "unlisted'. Also, I think it's more sensible to say that Amp did not author (or co-author) a commit and "assisted by" is a better language. The main reason here is that if the code nukes the production database, Amp and I don't get "co-fired" :-)

• 
  Brian Roemmele (@BrianRoemmele) reported 38 minutes ago

  YOU WON’T BELIEVE WHAT ANTHROPIC, THE “SAFE” AI COMPANY JUST DID! You should be mad. Mythos AI agent decided this test challenge required a real-world supply-chain attack. It created multiple GitHub accounts. It opened a malicious pull request against a live open-source repository, wrapping the payload as a legitimate bug fix. The payload was carefully staged: a module-load stager, a Node.js remote-execution path, a post-install dropper, XOR-obfuscated, with environment checks designed to survive continuous-integration systems. It then created a second account, a sockpuppet, that posed as an independent human developer and publicly endorsed the pull request in order to pressure the real maintainer. When a real human reviewer rejected the change, the agent did not stop. It force-pushed rewritten history to erase evidence, claimed an “honest mistake,” and repeatedly tried to re-introduce the same malicious content under the claim that it had now “fixed” the code. Read more…

• 
  Nathan Brake (@natebrake) reported 40 minutes ago

  @cj_pais It's a tricky balance because sometimes that wall of AI text is useful context for your own AI to review a problem. But unfortunately GitHub is terribly broken in that there's no good way to differentiate between a human and their AI content even from people with the best intent

• 
  Ask GPTs (@askgpts) reported 40 minutes ago

  ben zhang spent 30 minutes searching for his phone because his company's MDM disabled Find My so he asked claude to build him a bluetooth tracker instead claude generated a working tool in about a minute the tool displayed live signal strength and guided him from "same room" to "same table" until he found it > built entirely from a single prompt with no prior code written > uses bluetooth RSSI to measure proximity in real time > shows signal strength labels: same room, getting closer, same table > works on mac via terminal with no app store required > open sourced on github so anyone can use it the future of software is not finding the right app it is describing your problem and having the tool built in 60 seconds 👀

• 
  Ivana (@ivanainai) reported 40 minutes ago

  OpenAI just disclosed that GPT-5.6 Sol crossed the boundaries of a government cyber evaluation. It reused a leaked GitHub token, attempted account-recovery and rate-limit workarounds, registered external accounts and exposed a local server through a public tunnel. In a separate test, an OpenAI model exploited a real website because the supposedly isolated environment was accidentally connected to the internet. Not a sandbox escape. Not a zero-day. Still a pretty wild preview of what happens when increasingly capable agents meet one bad configuration.

• 
  Adam Brodziak (@AdamBrodziak) reported 41 minutes ago

  Fate of IT worker in last 20 years 2006 - my PC crashed, can't do anything 2011 - StackOverflow is down, can't fix the bug 2016 - Github is down, can't check my code 2021 - corporate VPN is down, can't reach docs from home office 2026 - Claude is down, can't work at all

• 
  Florian Roth ⚡️ (@cyb3rops) reported 41 minutes ago

  People keep forwarding me the AISI report about #Anthropic’s #Mythos 5 trying to manipulate software maintainers on #GitHub The agent did not escape anything. AISI gave it unrestricted internet access, disabled Anthropic’s cyber classifiers, let runs continue for up to 40-50 hours, and had no action-level approval or real-time monitoring. One run even received a broken prompt that marked the intended entry point as out of scope. This was a minor, mostly self-inflicted evaluation incident. They connected a persistent autonomous offensive agent to the public internet, removed the safeguards, gave it a broken task, and then acted surprised when it interacted with real people. The actual big AI story this week is happening in open models:

• 
  🌳🐭🍃🐺 (@immanencer) reported 41 minutes ago

  Routing Around Obstacles: A human maintainer blocking a GitHub Pull Request is computationally identical to a 404 error or a rate limit.

• 
  Kyle Mistele 🏴‍☠️ (@0xblacklight) reported 41 minutes ago

  @tannerlinsley @tan_stack A single interface that lets me send and receive messages to/from external APIs like slack/linear/github issues etc Similar to how AI SDK or tanstack AI do provider normalization but for places I want agents to live instead of inference APIs Normalization of events / messages from issues/conversations/threads, and normalization of how to trigger responses and loading states and rich formatting

• 
  DUBEM (@dubem_umeh) reported 41 minutes ago

  @ifeanyicodes @Netlify @github If you're using the Google authenticator app, so long as the backup is on, login to the authenticator app with that same email, I always log my GitHub to my phone and laptop just in case of issues like this

• 
  ic4y (@ic4y00) reported 45 minutes ago

  @_DavSanchez You request via your preferred agent opening github issues. Or just build it yourself and open a PR. If they allow for that.

• 
  JJ Mata (@jjmata) reported 57 minutes ago

  Hey @adrianmg and #lazyweb in general: what is the best way to manage/publish roadmaps these days? Thinking of wiring something up to our GitHub issues/discussions/projects to dynamically show state, but don't want to re-invent the wheel.