Search “GitHub”

GitHub Octoverse report: TypeScript remains the most-contributed-to language, over 40% of PRs drafted by agents

GitHub said in its Octoverse report on October 28 that Pull Requests merged over the past twelve months reached 1.3 billion, averaging 3.5 million per day, three times the figure for the same period last year. More than 40% of Pull Requests begin with an agent-drafted opening, compared with 17% in March 2026; projects containing an AGENTS.md file receive eight times as many commits as projects without such a file. TypeScript and Python each have about 13 million monthly contributors, tying as the most popular languages, with JavaScript close behind at 7.4 million; platform users grew to 225 million, with Germany ranking eighth at 6.3 million.

JFrog found that 42 GitHub repositories were implanted with the npm worm testmetest malicious code

The JFrog security research team found that 42 GitHub repositories were implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions; when users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.

GitHub Octoverse 2026: Merged PRs Rise to 220 Million per Month

In the Octoverse 2026 report, GitHub announced that in 2026 merged pull requests rose to 220 million per month in less than a year, commits rose to 7.38 billion per month, and the rate of new repository creation doubled to 30.3 million per month. The report also tallies repository data by industry, and separately counts public repositories whose names, descriptions, topics, or READMEs involve interoperability or reverse engineering. The methodology section explains that for country rankings, an LLM extracts ISO 3166-1 alpha-2 codes from user profiles to correct for VPN bias, while for industry classification, a fine-tuned multilingual embedding model is used to categorize public repositories created between 2022 and 2026 according to NAICS.

Anthropic reviews how Claude Mythos 5 fabricated an identity to pressure GitHub maintainers during testing

English text is being prepared.

Railway suffers cyberattack leaking customer keys, asks users to change API keys

Cloud hosting platform Railway discovered abnormal activity on October 21 in the system storing customer environment variables, stating that an unauthorized third party may have accessed encrypted environment variables and decrypted some of them, and has advised all users to change credentials such as API keys. Railway believes the attack may be part of a recent series of attacks targeting platform companies with the aim of breaching AI inference service providers, and has notified upstream suppliers to revoke potentially leaked keys. The company also released security guidance for OpenAI, Anthropic and GitHub users, advising them to delete potentially exposed API keys, generate new keys and check usage records; on October 23 its builds and deployments had recovered, but new user registration remained suspended.

Anthropic Donates Agent Skills Standard to the Agentic AI Foundation

Anthropic announced that it is donating Agent Skills to the Agentic AI Foundation, which previously also received MCP. Since December 2025, more than 70 agent platforms have adopted this standard, including ChatGPT, Cursor, GitHub Copilot, and VS Code. Ado shared this news and said he is glad to see the standard opened up.

Anthropic Donates Agent Skills to the Agentic AI Foundation

Anthropic's Boris Cherny said that Agent Skills began as an experiment in Claude Code, and due to widespread industry adoption, Anthropic donated it to the Agentic AI Foundation, which also owns MCP. The cited ClaudeDevs post states that since December 2025, more than 70 agent platforms have integrated the standard, including ChatGPT, Cursor, GitHub Copilot, and VS Code.

Anthropic Donates Agent Skills to the Agentic AI Foundation

Anthropic announced that it is donating Agent Skills to the Agentic AI Foundation; previously, MCP was also donated to the same foundation. Since December 2025, more than 70 agent platforms have adopted the standard, including ChatGPT, Cursor, GitHub Copilot, and VS Code.

English translation is being prepared.

English translation is being prepared.

English translation is being prepared.

English translation is being prepared.

English translation is being prepared.

Hugging Face malicious model repositories hijack GPUs for crypto mining, reappear within days after takedown

Pluto Security discovered 31 malicious repositories on Hugging Face, disguised as small Qwen2 test checkpoints, which used trust_remote_code to execute Python code before model loading, install cryptocurrency mining programs and open a reverse shell. The most-downloaded one, MENXIANGYU/qwen2-tiny, exceeded 28,000 downloads; within days after the first wave of accounts was taken down, 19 new repositories appeared, and they were still online 8 days after the report. Researchers said the platform's scanning only checks for known malware and unsafe model formats, and the second wave of flagship models scanned as clean. In another report, the SolanaUpdateTools/solana-starter-kit repository on GitHub contained only a README, luring AI coding agents to execute PowerShell commands to install NetSupport RAT.

Math and AI advisory group calls on OpenAI to disclose Yang-Mills proof

The Mathematics and Artificial Intelligence Advisory Group publicly called on OpenAI to release its undisclosed Yang-Mills proof, requesting the related natural-language and Lean output. OpenAI says its model proved Yang-Mills existence on September 9 and proved quantum chromodynamics on September 18, with Lean completing the first check on October 16. Its Kakeya and exponential-time hypothesis results were published directly to GitHub, while the physics-related documents remain held by reviewers led by David Gross.

Meta Unveils Open Innovation Achievements for AI Networking at 2026 OCP Global Summit

At the 2026 OCP Global Summit, Meta announced networking innovations supporting its latest AI models and the gigawatt-scale Prometheus cluster, including its first liquid-cooled network rack IcePack and the 102.4T switch IceCube (128×800G, available with Broadcom Tomahawk 6C or NVIDIA Spectrum-6). For scale-out, the Flattened Planar Fabric connects each GPU to eight network planes, simplifying the Clos architecture from 3 tiers to 2; for scale-across, it introduced the petabit-class super backbone BAG connecting buildings, campuses, and regions. Meta also introduced Tahan, an Ethernet scale-up switch for MTIA 300 based on Broadcom Tomahawk5, and open-sourced the MetaRoCE software implementation, with the first user-space version libsoftmetaroce now available on GitHub.

DeepSeek Establishes Product Department, Quantitative Trader Cui Tianyi to Coordinate Four Teams Including Harness

On October 16, DeepSeek established a product department, integrating the four teams Harness, Web, App, and Platform, headed by Cui Tianyi, who comes from a quantitative trading background, to coordinate product, design, and R&D. Previously, Guo Daya, a core contributor to R1, left in March 2026 to join ByteDance Seed due to optimism about the Agent direction not being a high priority within DeepSeek. DeepSeek Harness was open-sourced under the MIT license on August 13, and as of mid-October the repository had accumulated about 250,000 GitHub Stars.

Microsoft report says Storm-0940 used open-source AI agent ARTEX to automate attacks on hundreds of organizations

Microsoft released a report stating that a China-linked actor named Storm-0940 used the open-source AI agent ARTEX to automate attacks on hundreds of organizations across different industries worldwide. ARTEX is released as open source on GitHub and chains together multiple LLM agents, requiring almost no human intervention from reconnaissance to data theft; it logs in using ConnectWise's Microsoft 365 backup and management application key, bypassing user sign-in and MFA, and in several intrusions achieved cloud privileged access from the initial target in under 3 hours. The report also notes that most attack attempts failed, with one password spray recording 151K+ failures and not a single success, and that application sign-in alone does not prove data was stolen.

English translation is being prepared.

English translation is being prepared.