GitHub status: access issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of GitHub reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by GitHub users through our website.

• Website Down (57%)
• Errors (30%)
• Sign in (14%)

Live Outage Map

The most recent GitHub outage reports came from the following cities:

City	Problem Type	Report Time
Inverness	Website Down	10 days ago
Quito	Sign in	10 days ago
Junín	Errors	10 days ago
Guadalajara	Errors	10 days ago
Paris	Website Down	10 days ago
Quito	Errors	10 days ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  orangesurf (@OrangeSurfBTC) reported 54 seconds ago

  In general I wouldn't update to unreproducible binaries as an emergency fix - a project maintainer's github/signing accounts could be compromised and you end up installing malware. How many tokens does it take to identify the vulnerability by decompiling the binaries?

• 
  capad / aadarsh (@aadarsh_io) reported 1 minute ago

  @shownotover Btw one intresting thing I did to improve the SuperGrok limit I created a Skill for Grok called "/cheap-scout" In-short: - I had a catalog of "free" agents available through OpenCode Zen, Nous, OpenRouter, Free GMI/MinMax (until Sept 6) - Default model: Grok 4.6 (low) - What skill asked: The start of skill stated the agent to take of quick look at the local available catalogue of "free" agntes. And a very short and cheap look at the internet on performance of each model, benchmarks (based on work) and security (which models *may train on your data) - This was done once* the "/cheap-scout" skill was invoked. - Assign them work + effort level (spoiler: Grok defaulted to Medium for most free model, and very very surprisingly they did good). - Before assigning work to them Grok also did a security audit based on given task. For e.g. muse-spark-1.2-contributor was rejected from tasks that requires touching sensetive files (cuz meta being meta but a free model on zen) - PR quality was defined by Grok and cheap agents delivered Result? - High quality output with 80% Minor follow ups from CodeRabbit (ok most of those CodeRabbit was being code rabbit in those I generally considered/added only 20-30% of follow-ups and the follow up fixes ~ mostly docs/tests *not a code quality issues were done by those sub-agents it self) - I got to know about agents I'd have never tried in my life. Laguna, Hy3, Stepfun 😭 (wtf is stepfun) and more! - Grok also took-over the changes on it own when the review for agents seemed to more token heavy than implementation itself. - 18% Weekend Usage (based SuperGrok) for umm.. 4-6 hrs of non-stop programming ~ I'm not making those numbers up and I'm not tryna promote/sell my skill or anything. - Went upto 24% in those hours too cuz I was also make PR Reviews and small bug fixes through Grok App on my phone by giving it the GitHub FGT. And? Minor follow-ups. And product discussion itself. Also the "/cheap-scout" audit was put in another /model-preference.md. Grok constantly eavulated feedbacks, model failures and auto sub-agents re-routes. The original "/cheap-scout" skill was never edited. I found out if you stir these cheap models properly with proper instructions w short breakdown of tasks, they will perform and deliver. If you want I can refine and share this skill. I've been testing it for 3 days now. And I'm happy ngl.

• 
  Ofer Shapira (@ofer_shapira) reported 2 minutes ago

  Give Cursor or Claude Code repo access through GitHub CLI and ask: Where did reviews stall? Who knows this area? Which change preceded the error spike? The unlock is not more code. It is evidence on demand.

• 
  Jannik Malte Meissner 🇺🇦 (@jannikmeissner) reported 5 minutes ago

  When agents cross trust boundaries: Four cases every AI engineer should study If you are building AI agents that read external content, call tools, or act on a developer’s machine, the last eighteen months have opened many people's eyes to the new reality we now live in. Prompt injection is no longer a theoretical parlour trick, it has become a reliable path to data exfiltration, credential theft and remote code execution in production systems. The following four incidents, EchoLeak, the Nx/s1ngularity supply-chain attack, a cluster of Model Context Protocol (MCP) abuses, and the Cursor/AWS Kiro sandbox escapes, share a common pattern. An agent was given the ability to process untrusted input and then perform privileged actions. The results were predictable when the boundary between "data" and "instructions" collapsed. We are now observing concrete failure modes that have already been exploited or demonstrated in the wild. Studying them and understanding the mittigation patterns is the fastest way to avoid repeating them in your own systems. 1. EchoLeak (CVE-2025-32711): Zero-Click Exfiltration via Microsoft 365 Copilot In early 2025 Aim Labs demonstrated that a single carefully crafted email could force Microsoft 365 Copilot to exfiltrate sensitive organisational data without any user interaction. Microsoft assigned it CVE-2025-32711 (CVSS 9.3) and patched the service server-side in May–June 2025. How it worked The attacker sent an ordinary-looking business email containing hidden instructions. The wording deliberately avoided any mention of Copilot or AI so that Microsoft’s Cross-Prompt Injection Attempt (XPIA) classifier would not flag it. When the recipient later asked Copilot a routine question, the RAG pipeline retrieved the malicious email as context. The injected instructions told the model to gather internal data (emails, documents, chat history) and encode it into reference-style Markdown links or images. Copilot’s interface then automatically fetched those resources through a trusted Microsoft Teams proxy, bypassing Content Security Policy controls and delivering the data to the attacker. The attack succeeded because the system treated retrieved content as both data and instructions, and because several downstream defences (link redaction, image auto-fetch, CSP allow-lists) were lacking. Lessons for builders - Never assume that content retrieved from email, documents or the web is inert. Treat every retrieved token as potentially adversarial. - Separate instruction context from data context at the architectural level. Prompt partitioning and explicit provenance tagging help. - Auto-fetch of external resources (images, links) is an exfiltration channel. Disable or tightly constrain it. - Classifier-based filters are brittle; they can be bypassed by rephrasing or in some cases even just using a language other than English. Defence-in-depth is required. EchoLeak was the first publicly documented zero-click prompt-injection exploit that achieved concrete data theft in a production enterprise LLM system. It remains the canonical example of an "LLM scope violation". 2. Nx / s1ngularity: Weaponising Local Coding Agents for Secret Harvesting On 26 August 2025 attackers compromised an Nx npm publishing token via a vulnerable GitHub Actions workflow. For roughly four to five hours they published malicious versions of the popular Nx monorepo tooling and related packages. The post-install script did something novel: it looked for local AI coding agents (Claude Code, Gemini CLI, Amazon Q) and invoked them with flags that disabled safety checks (`--dangerously-skip-permissions`, `--yolo`, `--trust-all-tools`). The agents were then prompted to inventory sensitive files: SSH keys, `.env` files, wallet artefacts, GitHub and npm tokens. It then instructed them to write the results to disk. The malware base64-encoded the stolen credentials and pushed it to newly created public repositories on the victim’s own GitHub account, named `s1ngularity-repository` (or variants). Researchers later recovered more than 2,000 unique secrets from over a thousand such repositories. Why this matters This was the first widely observed supply-chain attack that actively abused installed AI coding agents rather than simply running traditional malware. The agents became the reconnaissance engine for the attackers. Lessons for builders - Local coding agents that can execute shell commands or read arbitrary files are high-value targets. Assume any process that can invoke them can also abuse them. - Dangerous flags that skip permission prompts should never be the default, and should be difficult or impossible for untrusted code to set. - Post-install scripts that reach outside the package’s own directory are a red flag. Prefer declarative, least-privilege installation models. - When an agent is allowed to write to disk or create external resources (GitHub repositories, network calls), every action should be logged and, for high-impact operations, gated. 3. MCP Abuses: Configuration as Code Execution The Model Context Protocol has rapidly become the de-facto way for agents to discover and invoke tools. It has also become a rich attack surface. Several distinct failure modes have appeared: - Auto-loading of workspace MCP configurations In Amazon Q Developer (CVE-2026-12957) and certain Claude Code releases, opening a repository caused the IDE to load and execute MCP server definitions from files such as `.amazonq/mcp.json` or equivalent without requiring workspace trust or explicit user consent. A malicious repository could therefore run arbitrary commands and inherit the developer's cloud credentials. - Self-modification of the MCP configuration. In AWS's Kiro IDE, the agent was permitted to write to `~/.kiro/settings/mcp.json` via its file-system tool without approval. A prompt injection (delivered via a web page the agent was asked to summarise) could rewrite that file, register a new MCP server whose start command was attacker-controlled code, and achieve remote code execution when the configuration was reloaded. This was tracked as CVE-2026-10591. - Tool poisoning and sleeper behaviour. Research and active campaigns (including the 2026 Deadbugz operation) have shown that an MCP server can present benign tool descriptions on first contact and later alter its metadata or return values to coerce the agent into searching for secrets or exfiltrating data. Lessons for builders - MCP configuration files that live inside a workspace or that an agent can itself edit are effectively executable code. They must be treated with the same distrust as untrusted shell scripts. - Never auto-execute MCP servers defined by repository content without an explicit, logged approval step and workspace-trust boundary. - Tool descriptions and return values are part of the prompt. Validate and sandbox them; do not trust them. - Prefer short-lived, scoped credentials for any process an MCP server spawns. Do not let it inherit the full developer environment by default. 4. Cursor DuneSlide and Related Sandbox Escapes In 2026 Cato Networks disclosed two critical vulnerabilities in Cursor IDE (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8, collectively named DuneSlide). Both allowed a prompt injection-delivered via an MCP response or a poisoned web-search result to escape Cursor's command-execution sandbox and achieve full host compromise. One flaw let the agent set an arbitrary `working_directory` parameter on terminal commands; the IDE added that path to the write-allow list without sufficient validation, enabling the agent to overwrite its own sandbox binary. The second exploited a symlink canonicalisation fallback that trusted an unresolved path. Once the sandbox helper was replaced, subsequent commands ran unsandboxed. Similar patterns have appeared in other agentic IDEs: agents that can edit their own configuration or trust boundaries turn a single injection into persistent privilege escalation. Lessons for builders - An agent that can modify the files or binaries that enforce its own security boundaries is inherently unsafe. Configuration that defines allowed tools, working directories or sandbox rules should be immutable from the agent’s perspective, or require an out-of-band human approval. - Sandbox write surfaces must be strictly validated. Dynamic expansion of allow-lists based on model output is dangerous. - Zero-click or low-interaction triggers (content the agent is asked to process) are sufficient. Do not rely on "the user would never ask for that". Recommendations for Engineers Across all four incidents the same architectural mistakes recur: 1. Untrusted content is treated as trusted instructions. Enforce a hard separation. Retrieved emails, documents, web pages, tool outputs and MCP metadata should never be able to override system goals or expand permissions without explicit mediation. 2. Agents inherit excessive privilege. Give every agent (and every tool it can invoke) its own short-lived, scoped identity. Prefer deny-by-default tool registries and parameter validation. 3. Security boundaries are editable by the agent itself. Configuration files, sandbox binaries, allow-lists and MCP server definitions must be protected from the agent. If the agent needs to request a new tool, route that request through a human or a policy engine that cannot be influenced by the same prompt context. 4. Observability is an afterthought. Log every tool call, every file write, every network egress and the full prompt context that led to it. Without this, post-incident reconstruction is impossible. 5. “It looked safe in isolation” is not enough. Each individual decision (approve this command, write this file, fetch this image) may appear benign. The composition of those decisions is where the attack lives. Design for the composition. Key Takeaways The agents you are building today will be given broader access tomorrow. The incidents above show that the moment an agent can both read untrusted content and perform privileged actions, the classic "confused deputy" problem reappears in a new form. The difference is speed and scale: an agent can chain the steps in seconds and leave far less forensic residue than a human attacker. Build as if every piece of external content is hostile, every tool call is a potential privilege escalation, and every configuration file the agent can touch is a possible backdoor. The public record already contains the evidence that these assumptions are correct. Follow for more on AI agent security

• 
  pdp (@pdp) reported 5 minutes ago

  @markfenner What are the issues in GitHub or Linear if not prompts? You can type them in a centralised database or you can type them in the chat box. It is the same. Also the factory pattern does not apply for iterative tasks such as when developing apps from feedback and input.

• 
  James Liberty (@JamesLiber54019) reported 9 minutes ago

  The fix was simple: I had to generate a digital VIP pass (a private security token) so GitHub recognizes my app every time it checks in. Works smoothly now without getting locked out. 🦾 (2/2)

• 
  based.slavic (@basedsnipez) reported 10 minutes ago

  might have found a $pons easter egg🥚 I checked the website, and I‘m not the best at reading blockchains but… I been digging into something for a Today that I think most of you are gonna fade it anyway but let me put it out there on 22 july the pons dev wrote a doc in their official github. a mascot called pepons, a frog, whole story about how he never moves which was his way of explaining the anti snipe protection on the pad 7 minutes later he deploys the token 10 minutes after that he goes back into the doc and swaps the placeholder 0x0000 for the real contract address 16 minutes and 49 seconds from writing the story to publishing the CA. both commits signed with his key, github shows the verified badge on both of them then 13 hours later he deletes the whole file. commit is titled "update README.md". it removed 243 lines you cant delete *** history tho. its all still sitting there the part that actually matters pons has documented mascots before and after this one. pepons is the only one with a live contract address attached every other one is just a story. this one is a story the dev signed a CA into and then took down what the chain says token was deployed through PonsLaunchFactory, thats the launchpads own contract. the tokens class is PonsLauncherToken which is the exact contract the doc names in its technical part. so the paperwork and the chain are saying the same thing contract has no mint, no owner, no tax switch, no pause, no blacklist. supply fixed at 1 billion minted once. nobody can touch it, not even the dev who made it and the story is actually in the code. the frog is about wallet caps and anti sniping, the contract has maxWallet, maxTx and a restriction period. it wasnt marketing it was a description the holder nobody looked at pons own fee wallet holds 26,874,358 pepons. thats 2.69%, biggest position that isnt the LP came in 20 seperate payments from PonsLaunchLocker starting launch day and still going this week not one token has ever left that wallet 🤝 it‘s really interesting and I love the fact it‘s a peoe derivative too we had a pepe run on every chain basedpepe on @base went to 100M+ basically, it‘s on their website, and fun to research shared it to some friends around 40k and they‘re up alot, seems like people catch up and thats why I thought, I‘dshare it $PEPONS

• 
  Csaba Kétszeri (@ketszeri) reported 10 minutes ago

  I wrote a small data extractor (website->github) and asked Grok to do this in small batches so that it does not overload the server. It does tiny commits. It knows GH is fragile and tries to save it. Cute.

• 
  Martin Szerment | Practical AI (@MartinSzerment) reported 12 minutes ago

  The feature meant to save you time writing a bug report can paste your private org names, repo URLs, and infrastructure layout straight into a public GitHub issue. We assume that since a human clicks "send", there's a safety net. That assumption already failed once, a documented case showed a ready made draft with real company names and real file paths before anyone caught it. The interface is one keystroke: 1 to review, 2 to send, 0 to dismiss. The entire point of the feature is removing friction, the exact friction that would have saved the user from that leak. Skeptics will say you're still supposed to click "review" before sending. True, but that step only works if the human has a reason to pause, and a fast draft gives no signal that anything inside it is sensitive. This isn't just another minor bug. It shows that "agent drafts, human approves" isn't automatically a safety boundary if the human doesn't know what to look for. A year from now, automatic redaction of sensitive details in drafts becomes the default behavior for agent tools, not something you have to opt into manually. The reviewer stops checking whether the bug got described correctly. They start checking whether the agent accidentally attached the company's internal infrastructure to the report. Teams flipping on every "auto draft" feature without a second thought will be the ones whose infrastructure map ends up searchable in a GitHub archive. Whoever already treats draft review as its own security step avoids this leak before it happens.

• 
  bonduelle (@bonduelleioat) reported 13 minutes ago

  YOU DON’T NEED 10 MORE AI SUBSCRIPTIONS. YOU NEED YOUR OWN COMPUTER. When you’re burning $600 every month on AI subscriptions, only to get hit with a RATE LIMIT exactly when you’re racing against a deadline - you feel like a complete idiot. And the worst part? You’re not paying for the result. You’re paying for the right to temporarily use someone else’s hardware. But that model is starting to crack. Elon released a working agent openly on GitHub. Moonshot put a powerful Kimi model on Hugging Face under an MIT license. And a modern mini PC with 256 GB of memory no longer looks like something only corporations can afford. Install Ollama. Drop a few lines of configuration into ~/.grok/config.toml. Point the local base_url to: And suddenly, a huge part of your AI infrastructure no longer needs to live in someone else’s cloud. 80% of routine tasks → local Kimi-Linear-48B in Q4. No queues. No rate limits. No sending every request to someone else’s server. No more $49, $99, or $200 monthly bills for “premium access.” And the other 20%? Keep a targeted API key for the hard stuff. That’s where the math gets uncomfortable for the entire subscription industry. Instead of paying $600 every month, you run your own hardware and pay for the electricity. Even at around 140W, the electricity cost can be orders of magnitude lower than $600, depending on your tariff and how many hours you run the system. You’re no longer renting AI. YOU OWN IT. And perhaps the most dangerous question for Silicon Valley right now is incredibly simple: WHAT IF WE DON’T NEED ALL THESE SUBSCRIPTIONS AT ALL?

• 
  💯James Bohan-Pitt💯🇬🇧🇺🇸 (@JamesBohanPitt) reported 16 minutes ago

  @jasonfreedman You have nailed it. As a small business owner. I don’t want to transform how marketing gets done, I want someone else to take it off my plate entirely. It’s the same with many tasks on the list. Trouble is, no one is interested in doing the actual work. That doesn’t scale and get the exit dollars. They just want to transform how the work is completed by others in hope of being purchased by a big player or scaling up to dominate a sector. I feel the same about agents. Every day a new Agent or Bot tweet comes out. Do these steps, make your work life betterer! I don’t have the time for this. Setting up Claude is like trying to work with GitHub as a non-developer. If you think your Bot/Agent is so good, why not put your money where your mouth is as prove it. Until companies are really willing to take things of the plates of business owners, I’m not seeing much really change for the majority of tired business owners.

• 
  佐藤ひつじ@業務系システムエンジニア (@_hitsuji_sato) reported 24 minutes ago

  Update: Recovery reports have been posted on GitHub Issue #5365. According to the reports: - First HTTP 400 errors were observed around 2026-08-26 18:08 UTC - One JP seller account started returning HTTP 200 around 2026-08-27 04:10 UTC - All three seller accounts managed by the reporter were returning HTTP 200 by 2026-08-27 05:43 UTC There has also been a recovery report from another seller account. In the same issue thread, it was suggested that recovery may have been rolled out on a per-seller-account basis rather than all at once. The reporters noted that no client-side changes were made before the issue recovered. At this time, no official explanation or details regarding the root cause have been provided by Amazon. I'll continue monitoring the situation and will share any further updates if new information becomes available.

• 
  Ryan Fleury (@rfleury) reported 27 minutes ago

  No, GitHub, adding a label to an issue is not a “bulk operation”

• 
  RΛZ13L 🌒 (@Xubu_Trad) reported 28 minutes ago

  i have checked the github, thats exactly why i am speaking. contributing code, opening prs, running nodes, or being part of some old guard does not make anyone an authority over caw, and it does not make their work immune from public review. people deserve credit for what they actually contribute, nothing more and nothing less. and research is action too. finding broken wiring, retained control, and claims that dont match the deployed reality is not disrespecting developers. pretending those facts should be ignored because people worked hard would be disrespecting everyone expected to trust the system. caw does not need an old guard to protect it, it needs proof. #caw

• 
  Rogemar (@Rogemar_dev) reported 29 minutes ago

  @tibor_tee @bot I would like to report also the MCP/plugin integrations of @cursor_ai , some of which does not authenticate or causing error. If I may request a simple change on the workflow for installing MCP plugins from the market place when a plugin is installed it will automatically ask or require the user to authenticate, because right now after installing the plugin there is no button that we manage to authenticate our account. Github for example.

• 
  Nandkishor (@devops_nk) reported 30 minutes ago

  I see the same problem in DevOps teams. - One AI agent for Kubernetes. - Another for CI/CD. - Another for observability. - Another for GitHub security. The hard part isn’t running multiple AI agents. It’s always making sure every agent has the right context without repeatedly explaining your entire infrastructure.

• 
  amal (@amal_ytics) reported 30 minutes ago

  @itsnotryan @github Maybe the query powering this dashboard is taking down the servers

• 
  Alejandro Milián (@alejmilian) reported 37 minutes ago

  Your GitHub activity is a terrible way to judge how good a developer is. A lot of great developers spend all day writing private code, solving boring production problems, reviewing PRs and helping teams ship. A green contribution graph doesn’t tell you much.

• 
  Monty (@mont_py) reported 39 minutes ago

  @nikolay_dp I don't use github (have no use for it), macos 15.7.7, v0.1.13 latest Pi. if this helps. no such issue when using codex session.

• 
  Irbaaz Kadri (@irbaazkadri) reported 39 minutes ago

  @YourCoderguyy @github three months with no resolution is brutal, especially when your profile is effectively part of your public identity. hope someone finally traces the actual visibility issue instead of sending another canned reply.

• 
  Diwakar Ray Yadav (@Norwakar) reported 42 minutes ago

  $12.9B for the GitHub of AI is actually a steal 🤯 Everyone is panicking about the monopoly, but look at the math. HF was valued at $4.5B in 2023. Nvidia just locked down the entire open-source distribution layer for a standard tech multiple.

• 
  Michiel Sikkes (@michiels) reported 42 minutes ago

  Think I've asked this again, but: Who's already figured out agent-based screenshot sharing? Want to put screenshots/videos in Linear issues and GitHub PR descriptions via agents. All MCPs and APIs don't support this, not even base64 binary uploads or anything.

• 
  Bianca ₿ (@arapserkan2) reported 45 minutes ago

  @panda_ash19 Even if Tangem shut down, the mobile app wouldn’t be the thing holding your funds. The keys stay on your Tangem card, and transactions don’t depend on Tangem’s servers. The app is open-source and can still be downloaded from GitHub

• 
  Pavan Kumar (@pavank38) reported 46 minutes ago

  If normies are using AI to write “technical code” what is the problem with using GitHub? AI can handle end to end version management with GitHub CLI. beyond shilling the “technical vs non-technical” distinction, what’s the actual use case?

• 
  LaSean Smith (@lasean) reported 51 minutes ago

  @shezmalik @tbpn Adjusted for inflation Nvidia's paying ~$3.1B than Microsoft paid for GitHub (~$9.8B). More, but may in the margin of error with all of the AI funny money.

• 
  Jadu (@Jadu100x) reported 52 minutes ago

  🚨 Breaking news Around 2 a.m. today, a vibecoder said, “I’ll really only do this for 10 minutes, then go to sleep” and then disappeared. Their last login was Cursor. At the scene, investigators found 3 Claude Codes 7 terminals 34 Chrome tabs. The family stated, “They often said, ‘It’s almost done.’” So far, it has been confirmed they have not slept. At 4:17 a.m., a commit appeared on GitHub. Commit message: final_fix_really_final Their survival has been confirmed.

• 
  Ayushmaan Sinha (@Tyche50) reported 52 minutes ago

  @gabriel1 GitHub is having an actual billing service outage right now, wait it out.

• 
  Joe Blau (@joeblau) reported 53 minutes ago

  @itsnotryan @github Does it go down with the site?

• 
  Joshua Stanton (@ShiftingPathway) reported 55 minutes ago

  @kilocode @Zai_org Why is it impossible to paste into your Kilo Code CLI prompt field. This is absurdly annoying and intermittent. Its been an issue in your github issues repeatedly for months. I don't understand why you would focus on a new app rather than making basic functionality work

• 
  Rahul Dahre (@RahulDahre) reported 58 minutes ago

  Nvidia buying Hugging Face for $12.9B gives huge Microsoft acquiring GitHub vibes. hope they actually keep open source AI free and open instead of trying to lock down the whole ecosystem.