Jay Parikh told Latent Space that GitHub now blocks a secret push before it enters the repo. The demo showed the check firing on an accidental push, so that failure needs no remote attacker. The same hardening push covers npm packages, where the attacker is remote and compromise spreads downstream.
The scale explains the urgency.
Parikh put GitHub at 225 million developers as of this year, with a new developer joining every second for the second straight year. He also cited 34.3 billion commits, 17.9 billion code pushes and 1.3 billion pull requests, and said about 40% of pull requests are now agent created after agent activity grew six times in six months. Open source contributions hit 1.5 billion, up two and a half times, which widens both review load and attack surface.
A harness is the runtime layer that wires models, tools and repo context together so an agent can act without losing state. GitHub runs the same Copilot harness in VS Code, on the web and in the GitHub Copilot app, so work started on a phone can continue on a laptop with issues, pull requests and security findings intact. Fusion is GitHub's orchestration system inside that harness that selects and coordinates models to optimize performance, cost and latency for each task, and it currently routes across models from Anthropic and OpenAI instead of forcing one model for all work.
In practice, Parikh said, the harness breaks a task down and picks a cheaper or stronger model for each step. That is meant to cut the cognitive load of choosing models and to let context compound in one place rather than scatter across tools. Developers still keep choice of models and tools, and Parikh said repos that never use pull requests should still work without ceremony.
The hard part is not finished. Parikh said GitHub is trying to migrate to Azure while traffic spikes, add deep scanning and Code Review Max for obscure bugs, and give enterprises spend controls and governance for token use. He was blunt that lots of work remains, especially on package manager abuse where GitHub uses delays and takedowns of compromised repos. You cannot fix that with one filter.
Watch the Azure move targeted for next year, the spend dashboards that recommend cheaper models, and whether secret blocking and review hold up as agents write more code. If you ship on GitHub, enforce secret push protection and AI review now and don't assume vendored code is safer to maintain alone.
