2 min read
What Happened to GitHub? Microsoft, Copilot and the Reliability and Security Problem
GitHub used to be the most reliable developer platform. Critical CVEs, a merge queue bug and outages tied to Copilot load show what happens when AI hype beats core reliability.
Microsoft took the only decent product they had left, GitHub, and started making a total mess out of it.
What was once the most reliable, developer-first platform in the industry has become increasingly unstable, bloated with half-baked AI features, and plagued by serious reliability and security issues.
A few months of GitHub incidents
Just in the first months of 2026:
- CVE-2026-3854 (March 2026): a critical remote code execution vulnerability in git push that could have let any user with push access compromise GitHub Enterprise servers.
- April 2026: a fresh batch of critical and high-severity CVEs for GitHub Enterprise Server, including one rated 9.6 Critical.
- April 23, 2026: a major merge queue bug silently broke 2,092+ pull requests across 658 repositories, reverting code without any warning or audit trail.
- February and March 2026: multiple degraded performance incidents and partial outages (at least 10 documented), with GitHub themselves blaming scaling issues tied to explosive AI and Copilot usage.
This isn't "just growing pains". This is what happens when a company shifts focus from building the best developer platform to pushing its Copilot AI at all costs, while core infrastructure, security and reliability take a backseat.
Microsoft had every resource to prevent this
Two months earlier I wrote about Microsoft more broadly. Here is a company with nearly unlimited resources to pentest and review everything it does. It has unlimited AI agents available that can hack better than most humans ever will.
Yet in February 2026 alone, Microsoft patched 59 vulnerabilities across Windows, Office and other products, including six zero-days that were already being exploited in the wild.
A long time ago Microsoft was an amazing company driving the economy. Today it has become a meme.
AI should make software more secure, not less
That's the irony. I'm a big believer in AI for software. I've written that writing code by hand is over. But the same tools that write code can review it, test it and attack it before anyone else does. A company with Microsoft's resources has no excuse not to point them at its own products first.
Shipping AI features is easy. Keeping the platform under them reliable and secure is the actual job.