GitHub recently faced major issues including a critical security vulnerability allowing remote code execution, a bug in its merge queue that caused silent deletion of code, and controversial AI data usage policies that use users’ private code for training unless they opt out. These problems highlight the risks and privacy concerns arising from GitHub’s increasing integration of AI and automation, prompting some developers to seek alternative, more secure code hosting solutions.
Recently, GitHub has faced significant challenges that have alarmed many users, revolving around a major security vulnerability, a critical platform bug, and controversial changes to its AI data usage policies. The first issue involved a severe security flaw in GitHub Enterprise Server, discovered by the cybersecurity team Whiz Research. This vulnerability allowed attackers to execute remote code on GitHub servers simply by pushing code with manipulated metadata, potentially compromising millions of repositories. The flaw, assigned a high-severity CVE score of 8.8, was quickly patched but raised concerns about hidden risks within GitHub’s infrastructure, especially as AI-assisted tools were used to uncover it.
The second problem emerged from GitHub’s merge queue (merge Q) feature, which caused serious bugs by merging code based on outdated commits rather than the latest main branch. This led to thousands of lines of code being silently deleted from main branches without any warnings or errors, affecting hundreds of repositories. The issue, which occurred around April 23, 2026, highlighted the risks of automating critical development workflows without sufficient safeguards, as the system overwrote current code with stale snapshots, causing significant disruption and loss of work.
The most contentious development involves GitHub Copilot’s updated data usage policy, which now defaults to using users’ coding activity—including inputs, outputs, code snippets, and project context—to train and improve AI models unless users explicitly opt out. This policy applies to both public and private repositories, meaning that private code can be used for AI training while users are actively coding. Many developers view this as a breach of trust and privacy, especially since participation is opt-out rather than opt-in, forcing users to take extra steps to protect their data.
This trio of issues reflects a broader shift in GitHub’s role from a straightforward code hosting platform to a complex, AI-integrated ecosystem under Microsoft’s ownership since 2018. While new features like AI assistance and automated workflows aim to enhance productivity, they have introduced new vulnerabilities, bugs, and privacy concerns. The increasing reliance on AI and automation without transparent controls has eroded user confidence, prompting some to consider alternatives that offer greater control and security over their code.
In response, some developers are turning to open-source solutions like Git T, which can be self-hosted to avoid cloud-based risks and AI data harvesting. The video encourages users to at least opt out of GitHub’s AI training program and to be aware of the evolving risks associated with hosting code on GitHub. Overall, these recent events serve as a cautionary tale about the complexities and potential downsides of integrating AI deeply into software development platforms without adequate safeguards and transparency.