GitHub is changing how it charges for Copilot usage, claiming that some users haven't been paying the full cost for AI.

Currently, GitHub Copilot uses a premium request unit (PRU) billing system, giving subscribers a set number of credits to spend for more complex queries.

The pricing scheme was introduced last year as a way to limit access to top models.

In a blog post detailing the move, GitHub’s chief product officer Mario Rodriguez said because Copilot has added new features, the company is contending with far higher compete and inference demands.

"Today, a quick chat question and a multi-hour autonomous coding session can cost the user the same amount," said Rodriguez.

"GitHub has absorbed much of the escalating inference cost behind that usage, but the current premium request model is no longer sustainable."

GitHub said that usage-based billing will better align pricing with how Copilot is being used. The new system will replace PRUs with GitHub AI Credits for subscribers, with the option for paid plans to buy more.

How the GitHub Copilot pricing changes will work

Each tier of GitHub Copilot subscription will come with a set number of credits, though paid plans will be able to top up.

"Credits will be consumed based on token usage, including input, output, and cached tokens, according to the published API rates for each model," Rodriguez explained.

Code completions and Next Edit suggestions will be included in subscription plans and not consume AI Credits, the company noted.

"Copilot code review will also consume GitHub Actions minutes, in addition to GitHub AI Credits. These minutes are billed at the same per-minute rates as other GitHub Actions workflows," he added.

Copilot will also end its "fallback" feature, which meant users who ran out of PRUs could fall back to a lower-cost model to keep working.

"Under the new model, usage will instead be governed by available credits and admin budget controls," he said. In short, if you run out of credits, you'll need to buy more.

Indeed, an FAQ document on the changes noted: "Users with intense agentic usage will likely see an increase in costs because those features consume more compute."

Managing costs

The shift to the new system will happen on 1 June, but GitHub will send customers a preview bill in their account Billing Overview page in May to help users and admins understand what their costs will be going forward.

There will be no change to monthly subscription prices, the company noted. A Copilot Business user costs $19/month, and will include $19 in monthly AI Credits.

Meanwhile, Copilot Enterprise will still cost $39/month per user, with $39 in monthly AI Credits.

To help smooth out the shift to the new pricing system, Business users will get a bonus of $30 monthly in AI Credits for June, July, and August, while Enterprise users will automatically get a bonus of $70 a month.

"We are also introducing pooled included usage across a business, which helps eliminate stranded capacity," Rodriguez said. "Instead of each user’s unused included usage being isolated, credits can be pooled across the organization."

That should help businesses give heavy users more credits, with lighter users offsetting the balance, GitHub suggested.

Admins will be able to cap budgets at the enterprise, cost center, and user levels, he added. When pooled credits are exhausted, users can decide whether to buy more or cap spending.

"You’ll have full control over what you spend, tools to track your usage, and the option to purchase more AI Credits if and when you need them," he added.

What does this mean for individual users?

For individual users, those on Copilot Pro and Pro+, their AI Credits will also match their subscription price of $10/month and $39/month, with those on an annual plan staying premium pricing until their subscription expires.

It’s worth noting that model multipliers will increase as of 1 June for those users. Once their plan expires, they'll be converted to Copilot Free and can then upgrade to a paid monthly plan.

Alternatively, annual subscribers can choose to convert to a monthly plan now.

Rodriguez said that temporary changes were made to those plans as well as Free and Student last week, in order to prepare for the new system.

"These were reliability and performance measures as we prepare for the broader transition to usage-based billing," he said. "We will loosen usage limits once usage-based billing is in effect."

FOLLOW US ON SOCIAL MEDIA

GitHub has announced plans to begin using customer interaction data to train AI models.

In a blog post detailing the move last week, GitHub’s chief product officer (CPO) Mario Rodriguez said the policy change will come into effect from 24 April onward.

Rodriguez said the move will enable the company to provide more intuitive AI capabilities for developers using the platform.

“By participating you’ll help our models better understand development workflows, deliver more accurate and secure code pattern suggestions, and improve their ability to help you catch potential bugs before they reach production,” he wrote.

Rodriguez noted that the company has already incorporated Microsoft interactions to fine tune model training processes, which so far have delivered marked improvements. Expanding the scheme to other users will support this at scale.

“The improvements we’ve seen by incorporating Microsoft interaction data indicate we can improve model performance for a more diverse range of use cases by training on real-world interaction data,” Rodriguez said.

So what do GitHub users need to know about the policy change?

What data will GitHub use to train AI models?

According to Rodriguez, customer interaction data set to be used by the company spans a range of areas, including:

• Outputs accepted or modified by the user
• Inputs sent to GitHub Copilot (including code snippets)
• Code context surrounding your cursor position
• Comments and documentation you write
• File names, repository structure, and navigation patters
• Interactions with Copilot features (including chat and inline suggestions)
• User feedback on suggestions (thumbs up/down ratings)

GitHub emphasized that there are some data types it will not use in AI model training, which includes interaction data from Copilot Business, Copilot Enterprise, or enterprise-owned repositories.

Similarly, content from issues, discussions, or private repos “at rest” won’t be used by the company - although there is a caveat here.

“We use the phrase “at rest” deliberately because Copilot does process code from private repositories when you are actively using Copilot,” Rodriguez explained.

“This interaction data is required to run the service and could be used for model training unless you opt out.”

Will GitHub share user data?

GitHub insists that data gathered as part of the program won’t be shared with third-party AI model providers or “other independent service providers”.

Notably, the company said that data “may be shared” with GitHub affiliates such as companies in its broader corporate family, including Microsoft.

In an FAQ section linked to the original blog post, GitHub did note that it may “engage service providers to assist with model training” on its behalf, albeit under the condition that this data is used “only for providing services to GitHub”.

What GitHub plans are affected?

The policy change from GitHub applies to specific subscription plans, with users on the aforementioned Business and Enterprise plans exempt.

Similarly, student and teacher accounts for GitHub Copilot are also exempt.

Customers who will be affected include those on Copilot Free, Pro, and Pro+ accounts, although you still have the option to opt out.

How to opt out

Opting out of the program is fairly straightforward, and Rodriguez confirmed that users who chose to opt out of product improvement data policies will retain these preferences.

“Your choice is preserved, and your data will not be used for training unless you opt in,” he wrote.

For those looking to opt out, users are advised to visit /settings/copilot/features. From there, under the “Privacy” section they will have an option to “Allow GitHub to use my data for AI model training” and disable the option.

FOLLOW US ON SOCIAL MEDIA

A host of big tech firms have handed over $12.5 million in funding to advance open source security and try to eliminate "AI slop" bug reports.

Firms including OpenAI, Anthropic, AWS, Google, Microsoft, and GitHub have pledged funding for Alpha-Omega and the Open Source Security Foundation (OpenSSF), both security initiatives within the Linux Foundation.

The aim is to develop long-term, sustainable security solutions that support open source communities worldwide.

The move comes as open source maintainers contend with an unprecedented number of security reports, many of which are generated by automated systems.

Mark Ryland, director of the Office of the CISO for AWS, said these AI-generated reports are overwhelming their ability to review them.

"Many of the reports are of very low quality — a reality given rise to the new industry term 'AI slop'," he said. "Many projects have already elected to put guidelines in place for AI submissions, while others have shut down upstream contributions entirely to prevent a flood of AI-generated pull requests."

Closer ties with open source maintainers

The new investment will allow Alpha-Omega and OpenSSF to work directly with maintainers and their communities to make emerging security capabilities accessible, practical, and aligned with existing project workflows.

“Grant funding alone is not going to help solve the problem that AI tools are causing today on open source security teams,” said Greg Kroah-Hartman of the Linux kernel project.

“OpenSSF has the active resources needed to support numerous projects that will help these overworked maintainers with the triage and processing of the increased AI-generated security reports they are currently receiving.”

The GitHub Secure Open Source Fund is adding an additional $5.5 million in Azure credits and funding to provide training and expertise.

GitHub Security Lab, meanwhile, is improving the security advisory experience on GitHub and Private Vulnerability Reporting (PVR) features, with an eye on reducing the burden of low-quality reports and helping maintainers manage increased volume.

Google, meanwhile, will provide AI-powered tools like Big Sleep and CodeMender from Google DeepMind – already used to protect the company's own systems. It's also extending research initiatives like Sec-Gemini to open source projects.

“Our commitment remains focused: to sustainably secure the entire lifecycle of open source software,” said Steve Fernandez, general manager of OpenSSF.

“By directly empowering the maintainers, we have an extraordinary opportunity to ensure that those at the front lines of software security have the tools and standards to take preventative measures to stay ahead of issues and build a more resilient ecosystem for everyone.”

AI slop reports are skyrocketing

Concerns about AI slop bug reports have been voiced by a number of organizations, including the Python Software Foundation.

Developers behind cURL, an open source command line interface (CLI) tool which allows developers to transfer data, recently shut down its bug bounty scheme in response to a growing number of slop reports.

As ITPro reported at the time, lead maintainer Daniel Stenberg said the current volume of submissions is placing a “high load” on the security team.

FOLLOW US ON SOCIAL MEDIA

Microsoft has issued patches for more than 60 flaws this month, including six zero-day vulnerabilities that are already being targeted by hackers.

As part of this month's "Patch Tuesday", Microsoft listed 58 vulnerabilities in its own software, as well as four in other tools, including Chromium.

While this number of flaws isn’t out of the ordinary, security expert Dustin Childs noted that the volume under active attack is “extraordinarily high”.

"Microsoft lists six bugs being exploited at the time of release, with three of these listed as publicly known."

Of the six zero-day flaws, five are rated as important and one moderate, rather than the more serious critical. As such vulnerabilities are already being targeted by hackers in the wild, quick patching is advised.

One targets Microsoft Word, allowing attackers to bypass local security features to access advanced control settings and possibly allow code execution. However, as Microsoft noted: "An attacker must send a user a malicious Office file and convince them to open it."

Another security feature bypass flaw being patched also requires user interaction, with a malicious link or shortcut file clicked before the attacker can make use of this bug to slip in.

"Successful exploitation lets the attacker suppress or evade the usual “are you sure?” security dialogs for untrusted content, making it easier to deliver and execute further payloads without raising user suspicion," said Malware Bytes security researcher Pieter Arntz in a blog post.

While users need to be tricked via a malicious link, Childs noted: "Still, a one-click bug to gain code execution is a rarity."

Other zero-day flaws being addressed by Microsoft include a denial of service bug targeting Windows Remote Access Connection Manager, an elevation of privilege vulnerability in Windows Remote Desktop Services, and a bug in Desktop Window Manager.

The last of the six zero-days affects Internet Explorer – though it may be long gone as a browser, it still lingers in Windows. Once again, users need to be fooled into clicking a malicious link to enable this attack.

"The bypass here is simply the ability to reach IE, which shouldn’t be possible," noted Childs, adding that calling IE "always results in a vulnerability somehow."

Patches issued for Azure, GitHub Copilot flaws

The remaining flaws patched by Microsoft included a trio of critical bugs spotted in Azure as well as vulnerabilities that could allow remote code execution in GitHub Copilot.

These flaws all center on a command injection vulnerability, noted Kevin Breem, senior director for cyber threat research at Immersive Labs, and can be triggered via prompt injection.

Breem said this could allow a hacker to embed a malicious prompt that's triggered when a developer uses an agent workflow, potentially slipping past existing security restrictions to run code or commands.

That's particularly problematic as developers may have access to sensitive data such as API keys, he added.

"Coupled with organizations enabling both developers and automation pipelines to use LLMs and Agentic AI with the right prompt, an attacker could have a significant impact," he noted.

"This is not to say stop using AI, but to ensure developers understand the risks and identify what has access to AI Agents, and lastly, least privilege can limit the impact if a developer's secrets are compromised."

FOLLOW US ON SOCIAL MEDIA

Amazon Web Services (AWS) is downplaying reports that a CodeBuild vulnerability could have compromised thousands of enterprise user accounts.

CodeBuild is a managed Continuous Integration (CI) service that’s often connected to GitHub repositories, triggering builds on events like new pull requests.

The vulnerability, dubbed by Wiz researchers as ‘CodeBreach’, stemmed from a subtle flaw in how core AWS GitHub repositories handled build triggers.

"The issue allowed a complete takeover of key AWS GitHub repositories - most notably the AWS JavaScript SDK, a core library that powers the AWS Console," said Wiz.

"By exploiting CodeBreach, attackers could have injected malicious code to launch a platform-wide compromise, potentially affecting not just the countless applications depending on the SDK, but the Console itself, threatening every AWS account."

Researchers found that just two missing characters in a Regex security filter - the start (^) and end ($) anchors - allowed unauthenticated attackers to compromise the build environment and leak privileged credentials.

These anchors are essential to ensuring an exact match; without them, the filter simply searches for a string that contains the pattern. As a result, Wiz said any GitHub user ID containing an approved maintainer’s ID as a substring would look legitimate.

“This creates a critical risk: if an attacker can compromise a single build, they are just a memory dump away from stealing credentials that often possess powerful permissions over the source repository,” the company explained in a blog post.

How the CodeBuild vulnerability was discovered

In dissecting the vulnerability, Wiz researchers created thousands of GitHub bot accounts until one matched the criteria, allowing them to push a pull request that looked legitimate.

This successfully extracted GitHub credentials for the aws-sdk-js-automation account, which had admin privileges over several AWS repositories, including private ones.

Wiz acknowledged that the issue wasn't a service-wide flaw, but warned that CodeBuild customers could introduce the same misconfiguration to their own projects.

The company disclosed its findings to AWS, which fixed the issue within 48 hours.

AWS also implemented global hardening measures within the CodeBuild service to prevent similar attacks, most notably with a new Pull Request Comment Approval build gate.

The company said it had audited all AWS-managed open source GitHub repositories, and found that none involved this type of misconfiguration.

"These activities had no impact to any AWS customer environments and did not impact any AWS services or infrastructure. No customer action is required," said the firm.

Regardless, Wiz recommends that CodeBuild users should enable the new Pull Request Comment Approval build gate or use CodeBuild-hosted runners to manage build triggers via GitHub workflows.

If there's really a need for webhook filters, they should ensure their regex patterns are anchored.

Organizations should also secure the CodeBuild-GitHub connection by generating a unique, fine-grained Personal Access Token (PAT) for each CodeBuild project, strictly limiting the PAT's permissions to the minimum required, and perhaps using a dedicated unprivileged GitHub account for the CodeBuild integration.

FOLLOW US ON SOCIAL MEDIA

Microsoft is reportedly reshuffling internal teams as part of a drive to stave off competition from up-and-coming AI coding startups and key competitors in the space.

According to reports from Business Insider, the tech giant has embarked on an overhaul of GitHub, aiming to ramp up agentic AI options and position the software development platform as the go-to option for developers.

Sources told the publication the move comes as both Microsoft and GitHub face heightened competition from key providers in the industry, such as Anthropic and Cursor.

Anthropic’s Claude Code tool has quickly emerged as one of the most popular AI tools for software developers globally, with other up-and-coming providers such as Cursor and Loveable gaining significant traction.

Microsoft appears concerned that competitors are now muscling in on GitHub’s dominant position in the space.

The tech giant acquired GitHub for $7.5 billion in 2018, and closer integration between the two has accelerated in recent years.

A new direction for Microsoft and GitHub

The overhaul at GitHub comes in the wake of a new focus for the tech giant toward improving internal synergy on AI offerings.

In January last year, chief executive Satya Nadella announced the launch of a new internal AI division dubbed ‘CoreAI - Platform and Tools’ and led by Jay Parikh. This, he said at the time, aimed to bolster collaboration between the AI and software engineering divisions.

A key focus here, according to Nadella, centered around enabling customers to build and deploy AI agents and applications in an easier manner by creating a singular stack spanning the breadth of its AI and Copilot solutions – with a build-out of GitHub Copilot another main objective.

The report from Business Insider points to an acceleration of this strategy and comes during a period of flux for GitHub. In August last year, GitHub CEO Thomas Dohmke announced his departure, having held the position since 2021.

Dohmke had deep roots at the company, first joining Microsoft in 2015 following the acquisition of his startup, HockApp.

As ITPro reported at the time, Dohmke’s departure signaled big changes for the developer platform, with its leadership team directly reporting to the CoreAI organization under Parikh.

Separate reports from CNBC noted that the remaining GitHub executives would report to Julia Liuson, former head of Microsoft's developer division and now an executive at the CoreAI group.

GitHub’s popularity is cemented

In GitHub, Microsoft has its hands on one of the most popular platforms for developers globally. At the time of Dohmke’s departure, the platform boasted over 150 million users, more than doubling from 73 million in 2021.

A key factor in its surging popularity across this period was the release of its Copilot assistant tool, launched under the leadership of Nat Friedman in 2021, which offers developers code suggestions and support.

A slew of AI features have been added to the service since then, and with the advent of agentic AI last year the shift toward coding agents has accelerated.

In May, GitHub announced the launch of a new dedicated coding agent at Microsoft Build 2025. This is designed to tackle “low-to-medium complexity tasks” and formed part of a sweeping update to the platform.

It isn’t alone in offering these types of services, however. Cursor Agent, for example, is capable of completing “complex coding tasks independently”, according to the company.

FOLLOW US ON SOCIAL MEDIA

The Shai-Hulud worm is back and once again infecting npm packages – and the scale of the attack is even greater than a September 2025 campaign which affected 180 repositories before containment.

Attackers involved in the campaign have been exploiting compromised package maintainer accounts to publish trojanized versions of legitimate npm packages that appear to originate from the official source.

Once downloaded, the malware scans for credentials and CI/CD secrets, which are then published to the user's own repositories. It also inserts the malicious payload into all of the users’ available npm packages, spreading the infection.

This time round, the malware has affected more than 19,000 GitHub repositories and compromised around 700 npm packages, including core libraries from Zapier and the Ethereum Name Service (ENS) ecosystem, along with PostHog and Postman.

According to Wiz Threat Research, the attack is accelerating at around 1,000 new repos every 30 minutes.

"This campaign continues the trend of npm supply-chain compromises referencing Shai-Hulud naming and tradecraft, though it may involve different actors," said Wiz.

New Shai-Hulud campaign shakes up tactics

This campaign adds a couple of new features, according to researchers, including execution using install lifecycle scripts and new payload files setup_bun.js and bun_environment.js.

Meanwhile, if the malware fails to authenticate or establish persistence, it attempts to destroy the victim’s entire home directory, deleting every writable file owned by the current user under their home folder.

Wiz said it's observed multiple environments where the affected packages were downloaded before their removal from npm, suggesting active exposure.

While GitHub is currently removing attacker-created repositories associated with this campaign, the threat actors continue to create new repositories as part of their ongoing activities.

Garrett Calpouzos, principal security researcher at Sonatype, said a peculiar aspect of the campaign is that it appears to be confusing AI analysis tools, largely due to the size and structure of the file.

“It’s so large that it exceeds a normal context window and the models can’t keep track of everything they're reading," he noted.

"I’ve asked both ChatGPT and Gemini to analyze it and I get different answers each time. Looking at their reasoning, they’re searching for obvious malware patterns – like calls to suspicious domains – and not finding any, so they incorrectly conclude it’s just a legitimate session or token management library."

What developers need to know

Developers should cross-reference all installed packages against the compromised list, said Aikido, and uninstall any compromised package versions immediately.

Enterprises are also advised to check GitHub accounts for unauthorized repos with "Shai Hulud: The Second Coming" in the description.

Credential rotation is another key tactic here for defenders, according to Wiz, with devs advised to check GitHub, npm, cloud, and CI/CD secrets used on any machine that installed these packages.

Elsewhere, enterprises should disable npm postinstall scripts in CI environments, enforce MFA on all GitHub and npm accounts, and stop auto-updates until verified clean.

"The timing is notable, given npm’s recent announcement that it will revoke classic tokens on December 9 after the wave of supply chain attacks," commented Charlie Eriksen, a malware researcher at Aikido.

"With many users still not migrated to trusted publishing, the attacker seized the moment for one more hit before npm’s deadline."

MORE FROM ITPRO

• Malware-free attacks: The threat to businesses
• Malware as a Service explained: What it is and why businesses should take note
• What is polymorphic malware?

A host of leading AI companies are leaking key data on GitHub and lack proper disclosure channels to even be notified of potential security problems.

That's according to research by cloud security firm Wiz, which examined 50 AI companies and found that 65% had leaked "verified secrets" on GitHub. Wiz said that could include data like API keys, tokens and credentials, many of which were buried deep in "deleted forks, gists and developer repos".

"Some of these leaks could have exposed organizational structures, training data, or even private models," Shay Berkovich, threat researcher at Wiz, and Rami McCarthy, principal security researcher at Wiz, said in a blog post.

The Wiz research follows a report earlier this year from Palo Alto Networks that showed data loss issues pinned on generative AI had more than doubled in early 2025, with AI data security incidents accounting for 14% of such problems across all software-as-a-service traffic.

Separate research last month suggested that AI coding tools are wreaking havoc themselves, with one-in-five CISOs saying they've suffered a major incident due to AI code. Such reports highlight the security risks posed by AI.

GitHub is a goldmine for threat actors

The Wiz researchers said they worked from the assumption that any big company with a large GitHub footprint likely has some exposed secrets, and worked their way through the Forbes AI 50 list to check that against leading AI companies, including big players like Anthropic and smaller startups.

Some didn't appear to use GitHub, but those that did were investigated by Wiz.

Leaks included keys that allowed access to insider data such as organizational members, which the researchers noted could be used by threat actors to target the company.

In another case, ElevenLabs API keys were listed in plaintext, which Wiz said suggested a relationship between vibe coding and leaking secrets.

Another company was leaking HuggingFace tokens in a deleted fork that allowed access to a thousand private models, as well as other data that revealed training details for private AI models.

One company had no public repositories and just 14 team members listed but still managed to leak sensitive data.

"Conversely, the company with the largest footprint without an exposed secret had 60 public repos and 28 organization members," researchers said.

What should companies do?

Wiz recommended companies run their own secret scans to ensure they aren't leaking such information, especially for anyone using a public Version Control System (VCS), but generally for all AI service providers.

"Too many shops leak their own API keys while 'eating their dogfood'," the researchers noted. "If your secret format is new, proactively engage vendors and the open source community to add support.

Wiz disclosed the leaks to all impacted companies, but in half of instances received no response or the message did not get through.

"Many lacked an official disclosure channel, failed to reply, and/or failed to resolve the issue," researchers said, calling for companies to ensure they have disclosure channels open and ready from day one.

"For AI innovators, the message is clear: speed cannot compromise security."

MORE FROM ITPRO

• AI security blunders have cyber professionals scrambling
• Some of the most popular open weight AI models show ‘profound susceptibility’ to jailbreak techniques
• Generative AI attacks are accelerating at an alarming rate

A raft of AI models from OpenAI, Anthropic, and Google have been officially cut from the GitHub Copilot service.

First announced in late September, users have had ample time to prepare for the deprecation cut-off date, which was confirmed in a blog post on 23 October.

The move comes as the company looks to usher users away from older models toward up-to-date options from the aforementioned providers.

“As part of our commitment to a fast, high‑quality Copilot experience, we regularly evaluate and retire older models in favor of newer, more capable ones,” the company said in September.

Anthropic models including Claude Sonnet 3.7, Claude Sonnet 3.7 Thinking, and Claude Opus 4 will be deprecated as part of the move while Gemini 2.0 Flash will be scrapped.

OpenAI models set for the chopping block include:

• GPT o3
• GPT o1 mini
• GPT 03 mini
• GPT 04 mini

What does this mean for GitHub users?

So what does this mean for users? Essentially, their use across “all GitHub Copilot experiences” will be removed, the company noted. This spans Copilot Chat, ask and agent modes, inline edits, and code competition tasks.

As a result of the move, GitHub has advised users to update workflows and integrations to use supported models.

“Copilot Enterprise administrators may need to enable access to alternative models through their model policies in Copilot settings,” GitHub said.

“As an administrator, you can verify availability by checking your individual Copilot settings and confirming that the policy is enabled for the specific model.”

GitHub added that no action is required on the part of admins to remove deprecated models.

If you’re wondering which alternative models are best following the deprecation cut-off date, GitHub has you covered.

Here’s a handy list of options:

MORE FROM ITPRO

• Everything you need to know about GitHub Models
• What Thomas Dohmke’s departure means for GitHub
• GitHub just unveiled a new AI coding agent for Copilot

The UK government has revealed its push to encourage AI use is delivering marked benefits for developers.

As part of an AI trial across government, more than 1,000 tech workers across 50 different departments trialed AI coding assistants from Microsoft, GitHub Copilot, and Google Gemini Code Assist between November 2024 and February this year.

Figures published following a review of the scheme shows developers are saving around one hour each day, equivalent to around 28 working days a year.

Technology minister Kanishka Narayan said the trial scheme highlights the benefits of rolling the technology out across government.

"For too long, essential public services have been slow to use new technology – we have a lot of catching up to do," said Narayan.

"These results show that our engineers are hungry to use AI to get that work done more quickly, and know how to use it safely."

Most of the time savings from the AI assistants came from using them to write first drafts of code that experts then edit, or using them to review existing code.

With only 15% of code generated by AI assistants being used without any edits, engineers have been taking care to check and correct outputs where needed, the government said.

The trial appears to have been popular with government coders, with 72% of users agreeing they offered good value for their organization. Nearly two-thirds (65%) reported that they were completing tasks more quickly and 56% said they could solve problems more efficiently.

Notably, more than half (58%) of participants said they would prefer not to return to working without these solutions.

Tara Brady, resident of Google Cloud EMEA, said the tech giant is “thrilled to see the positive impact” its AI coding tool delivered for government workers.

"This landmark trial, the largest of its kind for Gemini Code Assist in the UK public sector, underscores the transformative potential of AI in enhancing productivity and problem-solving for coding professionals, and highlights the successful collaboration stemming from Google Cloud’s Strategic Partnership Agreement with the UK government."

Prime minister Keir Starmer has been highly vocal about the government’s plans to roll out AI across government and public services since taking office. Downing Street hopes to save taxpayers more than £45 billion through the use of AI.

Questions remain over government AI coding gains

Martin Reynolds, field CTO at software delivery platform Harness, welcomed the move but questioned whether the plans go far enough. A key factor here, he noted, lies in the volume of manual remediation required by developers using AI-generated code.

"While AI is creating an initial velocity boost, 85% of government AI-generated code still needs to be manually edited by engineers,” he said.

“That's before it enters the more manual downstream stages of delivery, such as testing, security scanning, deployment, and continuous verification, which are essential to getting code into production safely and reliably," Reynolds added.

The quality of AI-generated code has become a recurring talking point in recent months. A recent study from Fastly, for example, found developers often find themselves manually remediating faulty code, which ultimately negates the time savings delivered by the technology.

Nigel Douglas, head of developer relations at software supply chain security firm Cloudsmith, also voiced concerns about potential security issues, saying there's not much evidence of secure-by-design thinking.

Given the critical nature of the work conducted by developers in key government departments, this should be a key focus moving forward.

“Without security-aware tooling or policy enforcement, you can easily see over-enthusiastic use of AI coding assistants unknowingly introducing vulnerabilities into one of this country’s most critical software ecosystems," he said.

"We’re getting past the point where it’s acceptable for software development teams to ‘hope for the best’ - you’ve got to be able to verify the provenance of the ingredients flowing through your software supply chain and into production systems, and you need tools to help respond to newly emerging threats that may impact what you’ve already deployed.”

MORE FROM ITPRO

• Not all software developers are sold on AI coding tools
• AI coding tools are booming – and developers in this one country are by far the most frequent users
• AI coding tools are finally delivering results for enterprises

GitHub is making it easier for software developers to make use of AI agents – and manage them like co-workers toiling in the background.

The company’s new "agents panel" allows developers to delegate tasks to the AI-powered Copilot from any page on github.com via a prompt, rather than navigating over to GitHub Issues – a process it says is "breaking your flow."

Earlier this year, GitHub unveiled a new coding agent designed to tackle "low-to-medium complexity” tasks. The aim with the new "mission control" tool is to help developers better manage AI.

A pop-up panel will allow developers to work with such AI agents more easily by delegating coding tasks and tracking progress wherever a developer is working in GitHub, with the Copilot agent working in the background before tagging the user for review when complete.

"If the past year has underscored anything, it’s that AI agents are becoming a bigger part of developers’ day-to-day workflows," staff product manager Tim Rogers wrote in a blog post.

"Copilot coding agent works like a member of your team, and it’s received a great response from developers so far," Rogers added. "But we know that not all of your work lives in GitHub Issues."

Previous to this Agents panel tool, developers using Copilot could allocate work for agents either by assigning an issue, using the pull requests extension for Visual Studio Code, or by triggering tasks from compatible apps that integrate with GitHub via the Model Context Protocol (MCP).

How GitHub’s new ‘mission control’ tool works

The new Agents panel is essentially a popup overlay that lets a developer trigger work by the Copilot agent, track existing tasks and review pull requests, all without leaving their current work setting, wherever that may be on the GitHub website.

To access the panel, click the "agents" button in the right of the navigation bar.

"You can start a new Copilot task from the new Agents panel with a simple prompt," Rogers noted.

"Just open the panel from any page on GitHub, describe your goal in natural language, and select the relevant repository. Copilot will then take it from there and start creating a plan, drafting changes, running tests, and then preparing a pull request."

The new feature is available on GitHub today in a public preview for all paid Copilot subscribers, the post added.

MORE FROM ITPRO

• What Thomas Dohmke’s departure means for GitHub
• GitHub just launched a new free tier for its Copilot coding assistant
• Everything you need to know about GitHub Models

GitHub CEO Thomas Dohmke has announced plans to step down, with big changes expected at the software development platform.

In a blog post published 11 August, Dohmke revealed his “startup roots have begun tugging on me” and he plans to launch an as-of-yet unknown new venture.

Dohmke has served as chief executive at GitHub since 2021, having joined Microsoft six years prior following the acquisition of his startup, HockeyApp.

GitHub was later acquired by Microsoft in 2018 for a fee of $7.5 billion, with Dohmke first moving over to the newly-integrated business unit as product chief before replacing Nat Friedman as chief executive in November 2021.

“Over a decade ago, my family and I made the leap to move from Germany to the United States after the sale of my startup to Microsoft,” Dohmke wrote.

“In the years since, I’ve had the privilege of working with many exceptional human beings, including Hubbers, Microsofties, customers, partners, our GitHub Stars, open source maintainers, and developers around the world who’ve helped us shape GitHub."

Dohmke isn’t stepping down immediately. Indeed, he noted that he’ll be “staying through the end of 2025” to help guide the company’s transition.

Thomas Dohmke’s exit could mean big changes at GitHub

Big changes are afoot at GitHub following Dohmke’s decision to step down. While the business is already closely integrated with Microsoft, deeper integration appears to be coming, he revealed.

Notably, Dohmke won’t be replaced as chief executive and GitHub’s leadership team will now report to Microsoft’s CoreAI organization in a more direct manner.

First announced in January 2025, the CoreAI division at Microsoft focuses on AI platform and tool development, and is led by former Meta executive Jay Parikh.

Exact details on how this will work weren’t revealed by Dohmke. However, according to reports from CNBC, a memo distributed by Parikh suggests that the remaining GitHub executives will now report to Julia Liuson, formerly the head of Microsoft's developer division and now an executive at the CoreAI segment.

GitHub has grown rapidly under Dohmke

GitHub has grown rapidly in recent years, now boasting over 150 million registered developers and marking a sharp increase from 73 million in 2021.

Dohmke noted that the company has observed a consistent increase in open source projects while in the last year alone the number of AI projects has doubled.

“With more than 1B repos and forks, and over 150 million developers, GitHub has never been stronger than it is today,” he said.

While the company’s flagship product, Copilot, was launched when Friedman served as chief executive, it’s under Dohmke’s leadership that the coding support tool has become increasingly popular.

Copilot now has over 20 million users, according to Dohmke, and a consistent flow of new features have been added in recent years.

As Dohmke points out, last year the company became the “first multi-model solution” at Microsoft, allowing developers to draw on a range of options, including those from OpenAI, Google, and Anthropic.

MORE FROM ITPRO

• GitHub just unveiled a new AI coding agent for Copilot
• GitHub CEO Thomas Dohmke thinks there’s still a place for junior developers in the age of AI
• GitHub just launched a new free tier for its Copilot coding assistant

While concerns are rising about the impact of generative AI on software developers, GitHub CEO Thomas Dohmke seems to have an optimistic outlook.

In a recent appearance on The Pragmatic Engineer podcast, Dohmke said that although AI tools are changing the face of the profession, claims that the technology will render junior developers obsolete are overblown.

Notably, junior developers play a crucial role in the natural hierarchy of development teams, Dohmke said, and bring with them new types of energy, ideas, and innovation.

“They come in with the latest learnings from colleges, diverse backgrounds, and a willingness to experiment,” he told host Gergely Orosz.

“The folks that are younger in career bring a new perspective to the team and say, ‘why don’t we try this?’ or ‘I want to incubate this idea’,” Dohmke added.

Simply put, junior devs help keep things fresh, keep the creative juices flowing, and support the more established, senior members of the team.

Notably, many developers now entering the workforce are AI native, so to speak - they’ve been using AI at college and university, or even earlier on in their academic journey.

This means they bring new perspectives and skills such as prompt engineering to the table. Crucially, they also boast an innate understanding of what consumers expect from applications and services.

GitHub putting its money where its mouth is on junior devs

During the interview, Dohmke emphasized that the company still values junior developers and runs an internship program for those hoping to enter the workforce.

This not only provides valuable experiences for aspiring developers, but also enables the company to embed younger generations within development teams to create a more diverse array of backgrounds and skillsets.

“We’re really excited about working with young people,” he said, adding that it had recently begun its summer internship program.

“We have three groups that start on different days and go through the internship,” Dohmke added.

“So those are the very early in career folks that still go to college or university. These interns get a full-time offer at the end of the internship, or maybe they come back for a second year.

“It’s lovely to see those folks that bring fresh ideas, a great amount of energy, and the latest learnings from college and university.”

Agentic AI is a threat, but not disastrous

Concerns over job losses as a result of AI have been simmering away since early 2023, but with the advent of agentic AI the issue has reached boiling point.

AI agents are capable of carrying out tasks on behalf of the work, rather than acting in a supporting role like your typical AI assistants. This marks a step change in how the technology can be used by enterprises - it’s fully autonomous.

A host of leading industry execs haven’t exactly calmed fears on this front, either.

Salesforce CEO Marc Benioff, for example, has waxed lyrical about the potential of AI agents in recent months. He even went so far as to suggest the company might slow down hiring of engineers as a result of its own successes integrating the technology internally.

Dohmke acknowledged that there are genuine concerns among developers about the future of agentic AI, but once again appears confident that it won’t result in mass job losses or a complete overhaul of the profession.

Ultimately, these tools still require human oversight and do have limitations.

“I don’t like the term ‘autonomous’, because I think autonomous, at least in my understanding, means the thing figures out itself what it should work on,” he explained. “That’s not how these things work. They have a level of autonomy, then you assign a task to them.”

Dohmke noted that this autonomy is restricted in a range of ways, such as by the model context protocol (MCP) that it’s configured through. Similarly, developers will also have control over which repositories agents are given access to.

It’s this control and oversight that limits their ability to be fully ‘autonomous’, he noted.

“As an engineer, as a human engineer, I can look beyond the one repository boundary and see what has been happening in other repositories, while the agent needs to get permission to do that right?”

“So we are definitely far away from full self-driving, if you take cars as a metaphor here, but we are certainly getting into more driver assistance systems. And as developers, we have always automated whatever we can automate, right?”

It’s still a bleak market for entry-level workers

Dohmke’s comments on junior developers comes amid a challenging period for entry-level workers across a range of industries.

Reports in recent weeks have warned that younger generations entering the workforce face an increasingly strained labor market as a result of AI adoption.

All told, the influx of AI tools and the push toward more automated operations at enterprises means job openings are decreasing.

A study from SignalFire, for example, revealed a marked reduction in tech companies hiring recent college graduates across 2024. While the report noted that macroeconomic conditions are a key factor in sluggish hiring rates, growing AI adoption rates are also contributing to the trend.

The issue has even prompted stark warnings from leading industry figures, including Anthropic CEO Dario Amodei, who suggested that around half of white-collar entry-level jobs could be wiped out by the technology in the coming years.

In an interview with Axios, Amodei said the industry should be more up-front about the technology’s potential threat to jobs.

“We, as the producers of this technology, have a duty and an obligation to be honest about what is coming,” he said. “I don’t think this is on people’s radar.”

MORE FROM ITPRO

• AI coding tools are finally delivering results for enterprises
• Microsoft CEO Satya Nadella joins Google’s Sundar Pichai in revealing the scale of AI-generated code at the tech giants
• Want developers to build secure software? You need to ditch these two programming languages

GitHub has announced new changes to its AI Copilot service in a move that looks to drive profitability – but it’s sparked ire among developers.

As part of a shake up of the service, the company will begin enforcing monthly limits on the most powerful AI coding models.

This policy change will affect a range of top industry models, including Anthropic’s Claude 3.5 and 3.7 Sonnet ranges, as well as Gemini 2.0 Flash and OpenAI’s o3-mini.

“Monthly premium request allowances for paid GitHub Copilot users are now in effect,” the company said in a blog post confirming the move.

Billing for additional requests will start at $0.04, GitHub confirmed. What this means is that users who now exceed monthly allowances on these models will be forced to wait until their next billing period, or agree to pay on a request-by-request basis.

How the GitHub Copilot pricing changes work

A ‘request’ essentially equates to every interaction with the Copilot tool, according to GitHub. This applies not only to generating code, but also natural language queries.

“Each time you send a prompt in a chat window or trigger a response from Copilot, you’re making a request,” the company explained in documentation.

‘Premium requests’, meanwhile, refer to more advanced processing power required by Copilot. Consumption rates on these particular requests vary wildly, and are often dependent on the AI model and features being used.

Copilot Chat, Agent Mode in Copilot Chat, Copilot Spaces, and Copilot coding agent all require premium requests.

Multipliers are also a major consideration here, with each model consuming premium requests based on respective compute power. For example, Gemini 2.0 Flash uses a 0.25x multiplier, while GPT-4.5 has a 50x multiplier.

This means a single interaction with the latter essentially counts as 50 premium requests.

As it stands, users on the GitHub Copilot Pro plan are entitled to 300 premium requests per month alongside an unlimited number of real-time code suggestions with what the company describes as “included models” such as GPT-4.1 and GPT-4o.

Copilot Business business users are also entitled to 300 premium requests while GitHub Copilot Enterprise users get 1,000 requests.

Developers aren’t happy about the price changes

This is by no means an out-of-the-blue announcement for GitHub customers. Earlier this year, the company first announced plans to implement a new premium request pricing system before temporarily delaying plans.

In a blog post at the time, CEO Thomas Dohmke outlined the proposed changes while confirming plans to launch a new Pro+ plan. This allows users to access 1,500 monthly premium requests for $39 per month.

There have been mixed reactions to the pricing changes among developers, at least if community comments are anything to go by. One user in particular noted that the premium request levels for the Pro plan fall short.

“300 premium requests are not enough for pro plan,” they wrote. “300 per day is ok, per month is ridiculous,” another added.

Another user hit out at the price changes, noting that instead of bolstering the options in the Pro+ plan, GitHub has “simply made the Pro plan worse”.

“This change doesn’t enhance the value of higher tiers,” they added. “It just limits existing functionality for paying users who expected more consistency in what they’re paying for.”

“This is my third year using Copilot, but to be honest, while more unnecessary services and features have been introduced, placing a 300-request cap feels quite unfair.”

The user added that they’re considering switching to alternative services, such as Cursor, once their annual subscription ends.

MORE FROM ITPRO

• Everything you need to know about GitHub Models, the new AI testing ‘playground’ for developers
• GitHub just launched a new free tier for its Copilot coding assistant
• Nearly a million devices were infected in a huge GitHub malvertising campaign

GitHub has unveiled the launch of a new coding agent as part of a sweeping update to its Copilot service.

Unveiled at Microsoft Build 2025, the new agent is designed specifically to tackle “low-to-medium complexity tasks”, the company said. The agent will be capable of adding features, fixing bugs, refactoring code, or improving documentation.

The agent operates in a temporary and customizable development environment, powered by GitHub Actions, and is designed to work in tandem with developers autonomously, rather than as an AI ‘assistant’.

In a blog post unveiling the new coding agent, CEO Thomas Dohmke explained the tool is embedded directly within GitHub and can be activated by assigning a GitHub issue to Copilot.

“The agent spins up a secure and fully customizable development environment powered by GitHub Actions,” he said. “As the agent works, it pushes commits to a draft pull request, and you can track it every step of the way through the agent session logs”.

What this means is that developers will be able to track and monitor the progress of the agent in any given task, providing complete observability and transparency throughout the process.

Similarly, all pull requests require human approval before CI/CD workflows are run, Dohmke noted, creating an “extra protection control for the build and deployment environment”.

“With the new coding agent, Copilot lives where developers collaborate with each other: right within GitHub,” Dohmke wrote.

“You can hand off the time consuming but boring tasks to Copilot, who will use pull requests, CI/CD, and all of your existing tooling while you focus on the interesting work.”

How GitHub’s new coding agent works

Want to get started with the new coding agent? You can use it now, according to GitHub, with the tool available immediately for all Copilot Enterprise and Copilot Pro+ users.

Getting started is also relatively simple, according to Dohmke. Users will be required to assign one or more GitHub issues to Copilot, which can be done through Github.com, on GitHub Mobile, or through the GitHub CLI.

“You can also ask Copilot to open a pull request from Copilot Chat like this: > Open a pull request to refactor this query generator into its own class Once an issue is assigned to it, the agent adds an 👀 emoji reaction and starts its work in the background.”

From here on, the agent uses GitHub Actions to boot a virtual machine, clones the selected repository, configures the environment and analyzes the codebase with retrieval augmented generation (RAG).

“As the agent works, it regularly pushes its changes to a draft pull request as git commits and updates the pull request’s description,” Dohmke added.

Throughout the process, users will be able to see the agent’s reasoning and validation steps in real-time via session logs. This, the company said, will make it “easy to trace decisions and spot issues”.

Once a task is complete, users will be notified and given the chance to review. This will also allow devs to leave comments asking to make changes, which will be picked up automatically and propose potential code changes.

“The agent also incorporates context from related issue or PR discussions and follows any custom repository instructions, allowing it to understand both the intent behind the task and the coding standards of the project,” Dohmke noted.

More agents for coding

The announcement from GitHub marks the latest in a string of AI-related updates to the platform.

The use of the technology in software development has become a leading use-case for big tech providers, with Microsoft, Google, Amazon, and others all launching AI coding tools over the last two years.

With agentic AI now the latest industry trend, it’s unsurprising to see GitHub jumping on the bandwagon in this regard. Indeed, just last week OpenAI unveiled its own coding agent, dubbed ‘Codex’.

Again, this agentic AI coding tool is designed to operate autonomously in tandem with the user, rather than an AI assistant which requires a higher degree of manual toil and tinkering for developers.

GitHub has been keen to highlight the benefits of AI for developers and engineers, with research from the firm last year showing the technology has delivered marked improvements to productivity and efficiency.

MORE FROM ITPRO

• GitHub's new 'Agent Mode' feature lets AI take the reins for developers
• Everything you need to know about GitHub Models, the new AI testing ‘playground’ for developers
• GitHub just launched a new free tier for its Copilot coding assistant

Microsoft CEO Satya Nadella says up to 30% of the tech giant’s code was written by AI, prompting more questions over the impact of the technology on software development.

Speaking during a fireside chat with Meta CEO Mark Zuckerberg at LlamaCon last month, Nadella revealed that anywhere between 20% to 30% of code was “written by software” - essentially meaning it’s AI-generated.

“I’d say maybe 20%, 30% of the code that is inside of our repos today and some of our projects are probably all written by software,” Nadella told Zuckerberg.

He added that the volume of code being written by AI at the firm is gradually increasing, but there have been mixed results across different programming languages.

Notably, the company has been making significant progress with AI-generated code in Python, while C++ has been a trickier endeavor. It’s no surprise Python has been a smoother experience for the firm – research from Snowflake last year revealed Python had emerged as the ‘language of choice’ for AI developers.

During the discussion, Zuckerberg also pointed to Meta’s own progress on this front, revealing that the company is developing an AI model capable of building future Llama models.

“Our bet is sort of that in the next year probably…maybe half the development is going to be done by AI, as opposed to people, and then that will just kind of increase from there,” Zuckerberg said.

The duo’s comments are the latest in a string of hints on the potential of AI tools in software development. Microsoft CTO Kevin Scott said he expects 95% of all code to be AI generated by 2030, for example.

Zuckerberg in particular has been outspoken on the matter, having told Joe Rogan earlier this year that the technology is reaching a point where it could replicate the work done by mid-level engineers.

“Probably in 2025 we at Meta, as well as the other companies that are basically working on this, are going to have an AI that can effectively be a sort of mid-level engineer at your company that can write code,” Zuckerberg told Rogan.

Microsoft and Meta aren’t alone in this AI-generated code push, either. Last year, Google CEO Sundar Pichai revealed around 25% of the company’s internal source code was generated by AI.

Speaking during an earnings call, Pichai told analysts that the firm has been using AI extensively within its development teams - mainly to improve coding processes and boost productivity and efficiency.

This code is subject to robust safeguards, Pichai insisted, with human approval required by engineers who are kept in the loop throughout the process. This helps improve engineer workflows and allows them to move faster, he said.

Is it curtains for developers in the age of AI?

Concerns over the potential for AI to render developers obsolete have been raised repeatedly over the last 18 months, with two distinct camps emerging on the issue.

Proponents of the technology have highlighted the benefits of integrating AI tools within daily workflows, with developers often reporting marked productivity and efficiency gains.

Research from GitHub last year found developers using AI solutions reported delivering more secure software, improvements to code quality, and faster adoption of new languages.

On the other hand, there have been reactionary claims that we could be facing an onslaught of AI-related job losses in the near future, but these haven’t quite materialized.

Regardless, comments from leading figures in the tech industry may have some devs looking over the shoulders - especially from Nadella.

The company recently announced plans to cut around 3% of its global workforce, and reports from Bloomberg suggest that programmers were among the worst affected in this most recent batch of layoffs.

With the cuts impacting nearly 2,000 staff at its Redmond headquarters in Washington State, state filings show around 40% of those were in software engineering roles.

Developers will have to adapt

Ultimately, developers will have to adapt to the influx of AI tools within the profession, according to Martin Reynolds, Field CTO at Harness.

“With technology’s biggest players like Microsoft using AI to write increasing volumes of their code, developers will need to adapt by focusing on tasks that require human judgment, creativity, and oversight,” he said.

“While there may be anxiety about job displacement, the trend also presents opportunities for software engineers to become more entrepreneurial by suggesting new projects, or work on more strategic and high-value tasks,” Reynolds added.

Reynolds added that while AI tools may improve efficiency, they do not represent a silver bullet for enterprises. Humans will always have to remain in the loop to ensure safety and quality.

“But let’s be clear, software engineers will remain integral in reviewing and debugging AI-written code to ensure quality and functionality. Current AI models can produce code efficiently, but may introduce bugs or suboptimal solutions, necessitating human intervention.”

Reynolds’ comments on adaptation align with previous research from Gartner on the topic of AI in software development. A study published by the consultancy last year noted that the technology will transform the profession and that around 80% of engineers will be forced to upskill by 2027.

But that doesn’t necessarily equate to job losses, the study insisted. Those who upskill to adapt to the influx of these tools within the profession will likely become the hottest talent in the industry.

Research from AWS in early 2024 highlighted this in particular, revealing that employers will be willing to pay up to a 31% premium on salaries for workers with AI skills.

MORE FROM ITPRO

• Want developers to build secure software? You need to ditch these two programming languages
• Developers should view AI as a “golden opportunity” and not a destroyer of jobs
• The NCSC wants developers to get serious on software security

More than 20,000 organizations may be at risk following a supply chain attack affecting tj-actions/changed-files GitHub Action.

GitHub Actions is a continuous integration and continuous delivery (CI/CD) service that enables developers to automate software builds and tests. Workflows are triggered by specific events, for example when new code is committed to the repository.

Used in more than 23,000 repositories, tj-actions/changed-files is a GitHub Action to retrieve all files and directories.

On Friday, a malicious commit in the Action was discovered by researchers at StepSecurity, whereby attackers modified its code and retroactively updated multiple version tags to reference the malicious commit.

"The compromised Action prints CI/CD secrets in GitHub Actions build logs," warned StepSecurity.

"If the workflow logs are publicly accessible (such as in public repositories), anyone could potentially read these logs and obtain exposed secrets. There is no evidence that the leaked secrets were exfiltrated to any remote network destination."

As a result, the compromised Action now executes a malicious Python script that dumps CI/CD secrets, impacting thousands of CI pipelines.

"This CVE impacts public GitHub repositories with GitHub Actions enabled. All versions were impacted," said Dimitri Stiliadis, CTO and co-founder of Endor Labs.

"For organizations that build software, they will likely need to reconfigure their pipelines if they are using the compromised Action. The attack shouldn’t generally cause outages for customers, but it could block organizations from making other changes."

Attackers may now attempt to compromise the software supply chain for other open source libraries, binaries, and artifacts created with the Action, researchers warned, potentially impacting thousands of open source packages.

"We have no evidence that any downstream open source library or containers has been impacted at this time. But we urge open source maintainers and the security community to join us in keeping a close eye out for potential secondary compromises," said Stiliadis.

"GitHub has removed the Action, and users must find alternative implementations. This means that CI pipelines using the compromised Action could crash unless you are using a cached version."

How to check for GitHub Action anomalies

StepSecurity advised users of any version of the tj-actions/changed-files Action to stop using it immediately until the incident is resolved.

It's released a free, secure, and drop-in replacement - step-security/changed-files - and recommended updating all instances of j-actions/changed-files in their workflows to this instead.

Users should also perform a code search across their repositories to discover all instances of the tj-actions/changed-files Action.

Reviews of GitHub Actions workflow run logs are also advised to uncover any recent executions of the Action. If any are discovered, they should be rotated immediately.

"The focus now has to be on what’s next. How long will it take the thousands of open source GitHub repos affected to take the proper security measures and revoke/change secrets?" commented Stiliadis.

"What can happen in the meantime is the damage can range from nothing to catastrophic scenarios, depending on who the attacker was and why they did it."

MORE FROM ITPRO

• Everything you need to know about GitHub Models, the new AI testing ‘playground’ for developers
• Hackers are abusing GitHub's search function to spread malware
• Nearly a million devices were infected in a huge GitHub malvertising campaign

Microsoft has alerted users to a malvertising campaign leveraging GitHub to infect nearly 1 million devices around the world.

A new advisory from Microsoft Threat Intelligence stated that in December 2024 it detected a large-scale campaign using the developer platform as the primary vehicle to deliver the initial access payloads used in attacks.

The campaign’s initial stage injects adverts into videos on illegal streaming platforms which redirect potential victims to malicious GitHub repositories.

The repositories, which have now been taken down, were used to deploy a series of files and scripts as part of a “modular and multi-stage approach to payload delivery, execution, and persistence”, Microsoft detailed.

“The files were used to collect system information and to set up further malware and scripts to exfiltrate documents and data from the compromised host.”

Some of these malicious payloads include Lumma stealer, an updated version of the Doenerium infostealer, as well as the use of the remote monitoring and management (RMM) tool NetSupport.

Microsoft said it was tracking the activity under an umbrella name Storm-0409 used to track a number of threat actors associated with remote access or infostealer malware, and who use malvertising campaigns to deliver these payloads.

The report noted that while GitHub was the primary platform used to deliver the malicious payloads, it also observed individual instances of the threat actors using Discord and Dropbox in the campaign too.

GitHub struggles to contain malicious actors

GitHub has become a popular destination for hackers looking to host their attack infrastructure, with a string of attacks specifically targeting developers on the platform in recent years.

Kevin Kirkwood, CISO at Exabeam, said he was encouraged to see Microsoft taking action to mitigate the abuse of its platforms by cyber criminals, but noted the campaign exposes a broader problem Microsoft and others are facing around controlling misuse of platforms.

"It’s great news to hear that Microsoft has taken steps to mitigate the problem of a very large set of operations that were occurring in a number of GitHub repositories,” he commented.

“The problem is the level playing field that free and open-source software (FOSS) delivery systems offer to both the normal development community and the threat actor community. The developer is cruising for new libraries and code snippets outside of the containment offered by the corporate environment and the threat actor is masking and putting out malicious code in order to do their ‘job’.”

Kirkwood added that by the very nature of being open, these platforms will never be totally safe from malign forces exploiting its permissive access conditions, but major players like GitHub could do more to create trust on the platform.

“The playing field may never change completely, but having a zone for curated and clean libraries, code, and code snippets that have been thoroughly vetted, as well as having developers that play within the controlled domains helps,” he explained.

“Managing the process where a wider search is needed for exploration for software solutions and scanning routines that can detect the run time behavior of inbound software will be the best case for FOSS seekers."

MORE FROM ITPRO

• Cobalt Strike abusers have been dealt a hammer blow
• Malicious GitHub repositories target users with malware
• Hackers have found yet another way to trick devs into downloading malware from GitHub

Security researchers have issued an alert over a campaign using GitHub repositories to distribute malware, with users lured in by fake projects.

Analysis from Kaspersky warned the unknown threat actors behind the campaign, which it dubbed ‘GitVenom’, had created over 200 repositories with various projects containing malicious code.

These fake projects included Telegram bots, video game hacking tools, Instagram automation utilities, and Bitcoin wallet managers covering a wide range of programming languages such as Python, JavaScript, C, C#, and C++.

The campaign uses a number of techniques to make itself appear legitimate, such as adding multiple tags to their repositories, displaying they have tens of thousands of commits, and ‘well-designed’ README files giving developers instruction on how to work with the code.

But the report noted that the features described in the README files never actually corresponded to the actual code in the project.

“[I]n reality, the code doesn’t do half of what it claims. But ‘thanks’ to [the README], victims end up downloading malicious components,” the firm said.

These malicious components include a Node.js stealer that collects credentials, crypto wallet data, and browser data and then packages the stolen information into a 7zip archive before sending it back to the attackers via Telegram.

The malware also included Quasar, an open source backdoor; AsyncRAT, an open source RAT that also functions as a keylogger; as well as a clipper that replaces any crypto wallet address in the target environment’s clipboard and replaces it with an attacker-controlled address.

According to the report, the group was able to divert almost $500,000 worth of Bitcoin to one of their addresses in November 2024 using this method.

Kaspersky added that the tens of thousands of commits were not, of course, the result of the threat actors manually updating each of the 200 repositories to maintain their authenticity, but by using timestamp files that updated every few minutes.

“The combination of detailed documentation and numerous commits creates the illusion that the code is genuine and safe to use,” it explained.

The GitHub campaign has been active for some time

Looking at the age of the oldest fake repository linked to the campaign, Kaspersky estimated that the campaign has been going on for around two years and has impacted developers in Brazil, Russia, and Turkey.

It noted the longevity of the campaign, stating that it was surprising that GitVenom has been able to persist for as long as it has.

Kaspersky advised that due to GitHub’s popularity, with over 100 million developers using the platform, it will remain a popular target for malicious actors.

With this in mind, users should remain highly vigilant when using the platform. Developers should always analyze the code they are thinking of integrating into their existing projects and use malware protection on both their computer and smartphone.

The report also advised to check less obvious indicators, such as the contribute accounts, number of stars, and the project creation date, although this is not a sure fire sign of authenticity as previous campaigns have manipulated GitHub’s star system to boost their malicious projects.

MORE FROM ITPRO

• 86% of enterprise codebases contain open source vulnerabilities
• Why ‘malware as a service’ is becoming a serious problem
• Hackers are using this new phishing technique to bypass MFA

Just 4% of workers are using AI tools in the majority of their daily tasks – but some key professions are flocking to the technology, according to new research from Anthropic.

Researchers at the AI company examined how its Claude model is being used, leveraging the data to help launch its own Economic Index that tracks the impact of AI on the economy over time.

AI is predicted to have major implications for the workforce, but there remains a lack of research into the subject. Because of that, Anthropic examined four million Claude.ai conversations, filtering them through tasks and occupations.

That enabled them to avoid using a survey, instead focusing on the actual data of how the model is used.

Notably, researchers found that half of AI use is currently concentrated in software development and writing, followed closely by analytical roles.

"The tasks and occupations with by far the largest adoption of AI in our dataset were those in the 'computer and mathematical' category, which in large part covers software engineering roles," the company said in a blog post.

"37.2% of queries sent to Claude were in this category, covering tasks like software modification, code debugging, and network troubleshooting."

A further 10% of queries was from those in arts, media, and design roles, which was largely made up of writing and editing.

Unsurprisingly, roles that require "physical manipulation of the environment" such as construction workers or anesthesiologists, have little use of AI.

"Interestingly, both low-paying and very-high-paying jobs had very low rates of AI use (these were generally jobs involving a large degree of manual dexterity, such as shampooers and obstetricians)," the blog post noted. "It was specific occupations in the mid-to-high median salary ranges, like computer programmers and copywriters, who were—in our data—among the heaviest users of AI."

Plus, the research revealed that AI peaks among top earners, but "drops off at both extremes of the wage spectrum", with the highest earners, such as physicians, and the lowest, such as hospitality workers, using AI very little.

"This pattern likely reflects either limitations in current AI capabilities, the inherent physical manipulation requirements of these roles, or both," they said.

AI use is growing steadily

With just 4% of workers using AI for three-quarters of their work, the study might suggested there is still some way to go until widespread adoption and use.

However, Anthropic found that around 36% of occupations are using AI for a quarter of associated tasks, suggesting that AI has “already begun to diffuse into task portfolios across a substantial portion of the workforce."

They added that it didn't appear any role was entirely completed by AI.

"As we predicted, there wasn’t evidence in this dataset of jobs being entirely automated: instead, AI was diffused across the many tasks in the economy, having stronger impacts for some groups of tasks than others," the blog post said.

The study also revealed that 57% of usage is to augment human capabilities — such as learning or iterating on output — while 43% is automation, such as fulfilling a request without human interaction.

"That is, in just over half of cases, AI was not being used to replace people doing tasks, but instead worked with them, engaging in tasks like validation (double-checking the user’s work), learning (helping the user acquire new knowledge and skills), and task iteration (helping the user brainstorm or otherwise doing repeated, generative tasks)," the company said.

AI in software development has been growing in popularity

The use of AI in software development has emerged as a leading use case over the last two years, with a host of companies launching tools to support devs in their daily activities - and workers have been flocking to the technology.

Research from GitHub last year found that 97% of developers had reported using AI tools at work, and many reported significant benefits from the technology.

Developers using these solutions said they were delivering more secure software, improved test case generation, and better quality code as a result of AI assistants.

The study showed universal agreement among developers that AI coding tools would deliver an overall improvement in code security and help to drive productivity.

The emergence of generative AI tools also came at a convenient time for many developers, with workers in the profession reporting surging rates of burnout and mental health issues as a result of their roles.

With solutions aimed specifically at reducing strenuous workloads and streamlining processes, AI was always going to represent a tantalizing opportunity.

It’s not all good news for developers using AI, however. A study from Gartner in late 2024 showed many developers and engineers might be forced to upskill in the coming years due to this influx of AI coding tools and a cross-industry push to automate roles.

Concerns over potential AI-related job losses in the profession have been further fueled by big tech exec comments on the potential of the technology.

Meta CEO Mark Zuckerberg recently suggested that engineers could soon be replaced by AI at the tech giant, while Salesforce chief exec Marc Benioff hinted that the firm could introduce a hiring freeze in engineering.

MORE FROM ITPRO

• Want to build secure software? Ditch these programming languages
• AI tools aren't helping devs save time on tasks
• Shadow AI is creeping its way into software development

GitHub has launched a new agentic AI tool for developers, dubbed ‘Agent Mode’, alongside a raft of updates to the Copilot service.

Agent Mode enables Copilot to iterate on its own outputs and complete entire user requests in one go, thereby automating broader aspects of the development process. It can also automatically fix errors, suggest terminal commands, and assess run-time errors.

Copilot will now iterate repeatedly on its output until all the necessary subtasks of a prompt are complete, GitHub CEO Thomas Dohmke said, and will infer additional tasks that were not specified but are necessary to fulfill the primary request.

The new agentic capabilities will improve Copilot Workspace, allowing collaborative users to leverage a system of sub-agents in the platform to improve efficiency when generating plans, implementing code, or fixing errors.

“Agent mode will change the way developers work in their editor; and as such, we will bring it to all IDEs that Copilot supports,” Dohmke said.

Another feature introduced to Copilot is the ‘Next Edit’ function, which can automatically identify and suggest edits of a user’s previous changes. Accessed by pressing tab, users will be able to browse suggestions throughout any open file.

Vision for Copilot was also unveiled, which will allow users to create a mock-up piece of code from a snippet of content, such as a shorter portion of code, a screenshot, or an image. With this, Copilot can generate the UI, alt text, and code.

GitHub referred to its forward-looking plan, ‘Project Padawan,’ through which developers will be able to assign entire issues to Copilot, let it complete the task, and then evaluate and review the results.

The next step in AI code assistance

This announcement could mark yet another significant step in AI-based code assistance, which has been gaining huge popularity as a use case amongst developers and businesses. Google recently revealed that over 25% of its proprietary code is now AI-generated, for example.

GitHub has been at the center of the AI coding conversation for a while, having released GitHub Copilot Enterprise in early 2024, which it followed up with the release of GitHub Copilot Workspace a couple of months later.

GitHub touts the benefits of its tools, claiming that GitHub Autofix fixes software vulnerabilities at more than three times the speed of manual fixes, and at more than seven times the speed for cross-site scripting vulnerabilities.

There have been questions raised about the effectiveness of AI coding tools, though, with one study finding that developer performance has largely remained unchanged despite the use of coding tools.

GitHub’s own research paints a more positive picture, however. Based on a survey of 2,000 software engineers and developers, the firm found that many reported several benefits related to AI coding tools.

Many said the tools improved code quality, helped deliver more secure software, improved test case generation, and allowed for the faster adoption of new languages.

These tools also enable better time utilization, with 47% of respondents in the US and Germany using the time they saved for collaboration and system design.

MORE FROM ITPRO

• Can AI code generation really replace human developers?
• The world's 'first AI software engineer' isn't living up to expectations
• AWS CEO Matt Garman thinks AI coding tools could herald the end of the developer as we know it

McAfee has uncovered new malware that's being used to target GitHub users with infostealing malware.

The security firm said it found several GitHub repositories offering video game hacks, cracked software, and free crypto tools that were not what they seemed.

They included game hacks for top-selling video games such as Apex Legends, Minecraft, Counter Strike 2.0, Roblox, Valorant, Fortnite, Call of Duty and GTA V, as well as cracked versions of popular software and services, such as Spotify Premium, FL Studio, Adobe Express, SketchUp Pro, Xbox Game Pass, and Discord.

"These attack chains begin when users would search for Game Hacks, cracked software or tools related to Cryptocurrency on the internet, where they would eventually come across GitHub repositories or YouTube Videos leading to such GitHub repositories, offering such software," said the team.

"We noticed a network of such repositories where the description of software keeps on changing, but the payload remains the same: a Lumma Stealer variant. Every week, a new set of repositories with a new malware variant is released, as the older repositories are detected and removed by GitHub."

The repositories even include distribution licenses and software screenshots to help make them appear legitimate.

There are claims that the package comes with an advanced Anti-Ban system, so their account won’t be suspended, and that the software has a popular community - indicating that it must be safe to use and that, by not using the software, they are missing out.

The repositories also contain instructions on how to download and run the malware. And, in some cases, they ask the user to disable Windows Defender and any anti-virus software first, claiming that because the software is related to game hacks, or by-passing software authentication or crypto-currency mining, anti-virus packages would detect and delete it.

"This social engineering technique, combined with the trustworthiness of GitHub works well in the favor of malware authors, enabling them to infect more users," the researchers said.

"Children are frequently targeted by such scams, as malware authors exploit their interest in game hacks by highlighting potential features and benefits, making it easier to infect more systems."

GitHub is often exploited for malware distribution, thanks to its easy accessibility, trustworthiness, and developer-friendly features. However, attackers can easily create free accounts and host repositories that appear legitimate, leveraging GitHub’s reputation to deceive users.

"The GitHub repository infection chain demonstrates how cybercriminals exploit accessibility and trustworthiness of popular websites such as GitHub, to distribute malware like Lumma Stealer," the researchers said.

"By leveraging the user’s desire to use game hacks, to be better at a certain video game or obtain licensed software for free, they trick users into infecting themselves."

It’s been a whirlwind two years in the generative AI race. Since ChatGPT launched in November 2022, we’ve gone from concerns over sentient world-killing AI supervillains to tempered expectations on what enterprises can actually gain from the technology.

While there’s obviously great potential in generative AI from a business perspective – be it cost savings, improvements to operational efficiency, and productivity boosts for staff – the messaging hasn’t quite matched up to the promises made by big tech providers.

That’s not to say gains haven’t been made, however. In certain roles and industry verticals, the technology is proving highly beneficial. Take software development, for example.

Research from GitHub this year found its Copilot AI coding assistant helped developers write code 55% faster. That’s a significant boost to efficiency by any standards, and it wasn’t the only advantage. Developers reported improvements to readability, maintainability, and reliability of code.

Of course, GitHub has a vested interest in promoting the incredible gains that can be unlocked by its proprietary tool. Alternative research has questioned the claims, noting that AI coding tools are actually causing more problems than they solve.

But there’s more to AI adoption than simply purchasing shiny new tools and throwing them at employees. A strategic approach to AI adoption across all levels of the enterprise is far trickier, time-consuming, and costly.

And it’s that last aspect of the equation that’s left many tech leaders in a rut.

2023 was a year of unbridled hype and hyperbole when it came to generative AI, with industry leaders like Microsoft making grandiose promises about how AI assistants, or ‘copilots’, will be a game changer.

But you would’ve been better off watching paint dry than keeping tabs on the news cycle for tangible use cases and case studies at that time.

Simply put, AI just wasn’t delivering financial gains for early adopters. In a study published earlier this year, IT leaders described return on investment (ROI) in AI as a ‘finger in the air’ exercise.

Confusion over when the benefits would arrive and when the coffers would start filling up has been a recurring theme of the generative AI era so far. According to Forrester’s Q2 AI Pulse Survey, around half of enterprise decision makers said their organisation expects a return on investment within one-to-three years.

Meanwhile, another 44% said they expect ROI to take far longer. Given the scale of investment required, it’s hardly surprising some tech leaders have been sweating.

Going into this period, purse strings were already tight and enterprises were cutting costs across the board. The fact many even had the financial flexibility to dive headlong into this latest industry trend is perplexing - maybe offloading thousands of workers helped loosen things up slightly.

Light on the horizon

Looking ahead to 2025, however, things are promising. In recent months we’ve seen tangible real-world examples of generative AI delivering on its promises.

Research from Google Cloud in August showed that seven-in-ten UK firms have already seen a positive ROI from the tech in at least one use case. Somewhere between 32% and 45% said they expect to achieve ROI on their roll-out strategies within the next year.

These ROI examples are all in distinct areas in the business, with the most promising use-cases arising in customer and field service roles. Digital commerce and customer experience are two other areas where firms are unlocking value, Google Cloud found.

Analysis from Microsoft and IDC also shows growing room for optimism on the ROI front, with a study published in November showing generative AI offers an ROI of $3.70 for every dollar invested.

Deployment times are also shrinking, the study noted, taking less than eight months to complete a roll-out, and an ROI within 13 months.

It’s taken a while, but we got there in the end, I guess.

Big tech providers aren’t content with standing still, however. We’ve got a new fad emerging in the broader industry now that will once again rule the airwaves in the year ahead - namely agentic AI.

Among the early champions of this new ‘era’ in the generative AI race has been Salesforce, which launched its Agentforce service in September this year. CEO Marc Benioff has been highly vocal about the benefits of agentic AI and at the firm’s Dreamforce conference took the opportunity to slam Microsoft’s Copilot service repeatedly.

Agentic AI represents a step change in how enterprises use the technology. Rather than investing in clunky AI assistants that sit adjacent to the human worker, agents will carry out tasks on their behalf.

So far, the signs are promising - albeit rather concerning if you’re a worker in the business segments agents will be embedded in.

Given it’s taken two years to begin truly unlocking value from generative AI, diving nose first into the latest trend will be a daunting task for many enterprise IT leaders, but one I’m sure they’ll still relish.

Discussions over return on investment with agentic AI will likely be the next rinse-and-repeat process for the industry.

GitHub has launched a new free tier of its Copilot AI coding assistant for developers using the Visual Studio Code (VS Code) developer environment.

There are limitations, however, and the free offer is intended for occasional users rather than full-time developers, which currently pay $10 a month for access to the AI-powered tool.

The offer includes 2,000 code completions and 50 chat messages each month, with access to Copilot edits and Copilot Extensions.

Users can choose from OpenAI's GPT-4o or Anthropic's Claude 3.5 Sonnet, rather than the full set offered to the paid-for subscriptions, which also includes Google Gemini 1.5 Pro and OpenAI o1-preview and o1-min.

The free tools are accessible by signing into a personal GitHub account. The company noted that it now has 150m developers using the platform.

"You can ask a coding question, explain existing code, or have it find a bug. You can execute edits across multiple files," said CEO Thomas Dohmke in a blog post.

"And you can access Copilot’s third-party agents or build your own extension."

Back to freemium

GitHub already offers Copilot Pro free of charge to students, schools, and the open source community, and that access won't change.

Indeed, Dohmke told TechCrunch in an interview that GitHub wanted to expand its free access.

“With Copilot Free, we are returning to our freemium roots and are laying the groundwork for something far greater: AI represents our best path to enabling a GitHub with one billion developers," he told the publication.

"There should be no barrier to entry for experiencing the joy of creating software."

Better for coders?

Free access will give a wider range of coders access to the tools, beyond those developing professionally in their day-to-day work. But it remains to be seen how useful such AI-powered tools are when it comes to producing code.

Back in September, GitHub released figures that found Copilot helped developers code 55% faster, while also slightly improving readability, reliability, maintainability, and conciseness.

However, research from Uplevel contradicted those findings, suggesting the rate of work completed was about the same, but bugs increased by an alarming 41%.

That said, at the time of its research, GitHub noted how difficult it can be to measure developer productivity, and what coders see as a "good day" has more to do with personal satisfaction and project progress than mere production of code — and, of course, the quality of code produced matters.

That suggests such AI coding tools might prove useful for some coders and less for others, perhaps depending on the nature of the project.

"Between 60–75% of users reported they feel more fulfilled with their job, feel less frustrated when coding, and are able to focus on more satisfying work when using GitHub Copilot," the company said at the time — and now at least no coder needs to pay to find out if that's true for them.

Just under a tenth (9.5%) of software engineers do almost no work, according to new research from academics at Stanford University.

One researcher, Yegor Denisov-Blanch, posted the findings to his X account, dubbing the staff who work less than 10% as hard as the median engineer as ‘ghost’ engineers.

These engineers do “virtually nothing,” Denisov-Blanch said, and it’s possible that some may even have multiple jobs.

The report used data from more than 50,000 engineers at hundreds of different companies. According to the paper itself, the researchers collected this data specifically from private commercial repositories and public repositories.

The research was undertaken to help automate the code review process via the use of an algorithm developed by the researchers. It was inspired, in part, by the demand for efficient software development practices.

“Manual code reviews are an essential but time-consuming part of software development, often leading reviewers to prioritize technical issues while skipping valuable assessments,” the researchers said.

“This paper presents an algorithmic model that automates aspects of code review typically avoided due to their complexity or subjectivity, such as assessing coding time, implementation time, and code complexity,” they added.

The research ultimately concluded that its algorithmic approach could offer a more effective and more comprehensive method for monitoring the productivity among engineers.

If engineers are slacking, then why is burnout rampant?

The claim that almost 10% of engineers aren’t pulling their weight appears to clash with the reality of life for developers and engineers across the industry, many of whom are overworked, stressed, and burned out.

Research from JetBrains found that nearly half (47%) of developers are now turning to mental and physical health applications to help cope with the onset of burnout from their roles.

Just over half of developers said that burnout is the primary reason for their colleagues to leave jobs, according to research from software firm Harness. Other research from Harness said high levels of burnout are causing businesses to spend as much as $1 trillion annually, underlining the significant strain placed on enterprises due to deteriorating wellbeing.

With 23% of developers reportedly working overtime for at least 10 days a month, there is evidently a large part of the developer workforce that is operating very differently from the ghost engineers detailed by Stanford researchers.

But workforce slackers are a genuine problem, with research showing that some workers do fake productivity levels

A recent study from Asana found that a significant portion of workers across a range of industries engage in what’s known as ‘productivity theater’, whereby they perform tasks to give the illusion of appearing productive.

Even if a small portion of a broader workforce is unproductive, this can have serious issues down the line. Asana's research showed this trend has a major impact on workforce efficiency, places a heavier burden on colleagues, and thereby contributes to heightened stress levels among productive workers

Developer productivity in the spotlight

Productivity among software developers, like other roles, has long been under scrutiny, and in recent years organizations have ramped up the use of AI tools to help drive it up.

Research from GitHub revealed that over 97% of developers have used AI coding tools in their workflow, with many noting they deliver more secure software and better code quality.

Alternative research from the firm - focusing specifically on its own GitHub Copilot tool - showed developers using the coding assistant completed tasks 55% faster than devs operating without the tool.

Meanwhile, similar research from Stack Overflow found AI coding tools are also helping to drive developer productivity.

In a recent survey, 71% of respondents cited the increased speed of code learning as a major benefit of AI. 61% of established professional developers also said this was a benefit.

Software development has frequently been identified as an area ripe for improvement through generative AI adoption, but a recent study has challenged perceptions around how beneficial AI coding tools are for developers.

The data science team at software development specialists Uplevel looked into the impact generative AI coding assistants are having on the efficiency and efficacy of developers.

The investigation found their performance has largely remained unchanged regardless of whether they are using AI tools or not.

Uplevel’s findings counter claims made by GitHub and other industry stakeholders, which have stated generative AI increases code quality and developer efficiency.

Uplevel Data Labs analyzed the performance of 800 developers among its customers, examining the difference in performance between teams with and without access to GitHub Copilot, one of the most popular AI coding assistants.

The research looked at metrics including cycle time, pull request (PR) throughput, bug rate, and extended working hours (also referred to as ‘always on’ time).

Uplevel found that, overall, Copilot provided no significant change in efficiency metrics.

Comparing the throughput, cycle time, and complexity of pull requests, including PRs with associated tests, the researchers found Copilot did not meaningfully help or hinder developers and had no effect on coding speed.

There was some change in certain metrics, but the actual changes recorded were deemed ‘inconsequential’. For example, Uplevel recorded a 1.7 minute decrease in average cycle time for developers with access to GitHub Copilot.

This clashes with findings from GitHub, which indicated that in the two years since GitHub Copilot was released to the public, developers were coding 55% faster.

Copilot-assisted code found to contain more errors

The developer platform recently published the results of another study of 202 developers, which found those with access to Copilot had increased functionality, readability, and overall code quality.

For example, GitHub found readability of code written with the assistance of Copilot improved by 3.62%, with similar increases in reliability (2.94%), maintainability (2.47%), and conciseness (4.16%).

GitHub said these numbers were statistically significant, but the findings from Uplevel’s investigation revealed more concerning effects of AI coding tools on code quality.

The firm found that while throughput stayed at around the same level code quality actually decreased, with significantly higher bug rates.

The bug rate in code generated by those using Copilot was found to have increased by 41%, which when taken alongside the fact that throughput was unchanged suggested that Copilot access may be hurting code quality, according to Uplevel.

Not only did Uplevel’s research indicate generative AI coding tools may not be helping improve developer’s efficiency or efficacy, but the data showed Copilot access was also not particularly effective in mitigating the risk of developer burnout.

Uplevel’s ‘Sustained Always On’ metric, which measures extended working time outside of standard hours – a primary indicator of burnout, was found to have decreased for both groups.

For those with Copilot access, this decrease was 17%, whereas it was measured at 28% for those not using the coding assistant.

Research indicates the appetite for AI coding tools among developers and business leaders has grown significantly in the last year or so, but the jury appears to still be out on whether these solutions are producing tangible value in the software development industry at the moment.

Over a quarter (25%) of Google’s internal source code is AI-generated, according to CEO Sundar Pichai, hinting at what's in store for the future of development at big tech firms.

Speaking during a recent earnings call, Pichai explained that the firm is using AI within its development teams to improve coding processes, as well as to boost productivity and efficiency.

The code in question is subject to human approval, Pichai added, as engineers are kept in the loop to review and accept AI-generated code. This helps improve engineer workflows and allows them to move faster, he said.

Google’s AI source code forms part of its full-stack approach to the technology, which Pichai noted also involves rolling out its Gemini models more widely to developers and focusing on tools such as GitHub Copilot.

Google’s announcement is a sign of things to come, according to Camden Woollven, Group Head of AI Product Marketing at GRC International Group, though it might take time for the entire industry to catch up.

“Google's got advantages other companies don't, such as massive code repositories, cutting-edge AI tools, and the resources to implement this safely,” Woollven told ITPro.

“Most companies won't hit 25% anytime soon, but they're definitely heading in that direction.”

It’s also important to put the headline statistic in context, Woollven said. While 25% of Google’s code is AI-generated, this doesn’t mean AI is writing full systems from scratch - rather, it’s complementing human development.

AI coding tool uptick

News of Google’s sizable AI code portfolio comes as research increasingly points to the growing popularity of AI coding tools.

According to a GitHub report that surveyed 2,000 software engineers and developers, 97% said that they had used AI coding tools at work at some point. Many of the surveyed developers also reported better code quality and faster language adoption.

A similar survey from Black Duck Software found that nine-in-ten developers reported using AI coding tools, with some of the most enthusiastic adopters working in technology and cybersecurity.

This uptick could have major implications for application development, according to Manoj Chaudhary, CTO of Jitterbit.

"Traditionally, building applications required dedicated developers, creating a bottleneck for businesses with limited resources. This meant a long tail of unmet needs, with countless applications left unbuilt due to the dependence on centralized IT teams,” Chaudhary told ITPro.

“AI is now breaking down these barriers. AI-powered tools are lowering the barriers to entry, allowing anyone with a basic understanding of what’s needed to automate tasks and processes,” he added.

Chaudhary argued that AI coding tools can democratize automation and create more agile, more productive environments.

Question marks over AI code 

Despite the apparent surge in AI code generation, the industry is not without its concerns. Reports show that many developers question the quality of AI-generated code and its maintainability.

According to a report from Google itself, 39% of surveyed developers do not trust and lack confidence in AI-generated code, despite three-quarters (75%) using AI for at least one daily responsibility.

Other research from GitClear, for example, found concerning trends around maintainability in 153 million lines of examined code, predicting that ‘code churn’ - code that must be changed after its completion - could double in 2024.

Black Duck’s research also pointed toward growing developer worries in this regard, with two-thirds of respondents noting they’re increasingly concerned about the security and safety of AI-generated code.

Python has overtaken JavaScript to become the most popular programming language on GitHub, according to new figures released by the firm, largely thanks to the rise of machine learning and generative AI.

The coding platform revealed that there are now 518 million projects on GitHub, up by a quarter year-on-year, with 5.2 billion contributions to projects over the course of 2024.

AI is having a major impact, the firm noted. There's now 137,000 public generative AI projects, almost doubling since last year, and more than a million open source maintainers, students, and teachers have used the free AI-powered GitHub Copilot tool.

With Python taking the top spot on GitHub, its ascendancy brings to an end ten years of JavaScript holding the top spot. Moving down to second, the programming language is followed by TypeScript and Java.

It’s not all bad news for the language, however. JavaScript is still the top ranked for code pushes — which means more developers use it more often to push code — but across all activities on the site, including commits, issues, pull requests and more, Python is now the top language.

"More developers still use JavaScript more often to push code, but in absolute activity across all contribution types on GitHub, Python now outranks JavaScript," GitHub said in a blog post.

Python's meteoric rise to prominence

GitHub identified two key factors behind Python's popularity on the platform - namely the rise of data science and generative AI, as well as TypeScript cutting into JavaScript's lead.

The firm said TypeScript had grown exponentially from 2014 to 2019, overtaking Java last year to join the top three programming languages.

"While Python is increasing in contributor counts for both code push activity alone and other activity faster than JavaScript, it isn’t increasing in those faster than JavaScript and TypeScript combined," the post noted.

"Rather than a slow down in the JavaScript community, what we are seeing is a transition to TypeScript for a large proportion of new commits."

It's not just Python that’s benefitted from the rise of machine learning either. Jupyter Notebooks has seen a spike in usage of 92% over the last year and 170% since 2022.

"This could indicate people in data science, AI, machine learning, and academia increasingly use GitHub," the post added.

GitHub's ranking echoes recent research by cloud data company Snowflake, which in March revealed Python had become the go-to programming language for developers building generative AI applications, pointing to 571% growth on its own platforms.

But Stack Overflow's 2023 survey ranked Python third overall, which it said was a reflection of who uses the language. It’s the fourth most popular programming language among professional developers, but more popular among those learning to code and the top ranked for those who aren't full time developers but use some coding at work.

That tracks with GitHub's assessment that the rise of AI and data science was drawing a wider range of people into coding.

"Python is used heavily across machine learning, data science, scientific computing, hobbyist, and home automation fields among others," GitHub added.

"The rise in Python usage correlates with large communities of people joining the open source community from across the STEM world rather than the traditional community of software developers.

"The notion of who a developer is and the scope of what a developer does is changing. The rise in Python, HCL, and Jupyter Notebooks, among other things, indicates that the notion of a developer extends beyond software developers to roles like operations or IT developers, machine learning researchers, and data scientists."

Other shifts driven by AI

AI is helping to encourage coding globally by making it easier for people from a wider range of countries, GitHub said.

"The rise of these non-English, high-population regions is notable given that it is happening at the same time as the proliferation of generative AI tools, which are increasingly enabling developers to engage with code in their natural language," the post said.

And that's good news for the industry. By attracting a more diverse community of developers, this will ultimately drive innovation long-term, the firm noted.

"Increased access to and experimentation with AI could also simplify and personalize the coding journey for new developers, lowering entry barriers and further diversifying GitHub’s community of developers."

More widely, generative AI is becoming a core part of software development at every stage.

"They power coding tools that offer fixes and context behind vulnerability remediations, suggestions in response to natural language prompts and existing code, and facilitate learning among new and experienced developers alike," the post added.

"They’re also changing how developers build applications, and developers will benefit from platforms that allow them to easily experiment with AI models as building blocks without requiring separate setups or extra costs."

Previous research from GitHub found that developers are beginning to unlock real value from AI coding tools, with respondents to a recent survey relieving the solutions have helped them learn new languages and save time.

Microsoft and Nvidia have teamed up to launch a generative AI accelerator for UK startups, offering them technical guidance, advice on marketing strategy, and access to a network of potential investors.

The Microsoft GenAI Accelerator is specifically tailored for UK AI startups and scale-ups that have secured seed funding and are now looking to develop their products further.

The accelerator is focused on products that could change people’s lives for the better, create jobs, and have significant economic impact, the two tech giants said.

"By supporting local AI start-ups and providing them with the resources they need to succeed, Microsoft and our partners are helping to build a vibrant and sustainable AI community in the UK and create the tech powerhouses of tomorrow," said Microsoft UK CEO Darren Hardman.

"These fast-growing companies will create jobs, boost UK economic growth, and create products that make a positive impact on people’s lives."

The program will run from 22 January to 5 March 2025 and will culminate in a Demo Day, during which participants will have the chance to showcase their products to top venture capitalists and private equity firm.

There will also be a hybrid format for the program – part online, part in person – which Microsoft said should make it easier for companies outside London and the south-east to take part.

Participants will be given one-to-one support from Microsoft’s AI Black Belt team, which specializes in AI and machine learning, as well as technical guidance, advice on marketing strategy, and access to workshops and help from Nvidia and Microsoft-owned GitHub.

"Nvidia will support Microsoft GenAI Accelerator participants through the Nvidia Inception programme for cutting-edge start-ups," said Serge Palaric, Nvidia’s vice-president for hyperscaler alliance in EMEA.

"This collaboration will provide startups with access to Nvidia Deep Learning Institute (DLI) training sessions and a network of experts. By using NVIDIA’s accelerated computing platform, startups will be able to accelerate their AI development and enhance performance."

Startups and scale-ups wanting to take part have until 22 November to apply, with a shortlist to be drawn up in early December.

UK-based AI startups and scale-ups which already have a product in the market and are innovating across various sectors, including fintech, medtech, and greentech, can apply.

Microsoft noted it's particularly keen on companies that are looking to build AI-native solutions on Microsoft’s cloud.

GitHub Copilot is going multi-model, with the company unveiling a raft of new options for developers to draw from.

Developers will now have the option of using Anthropic’s Claude 3.5 Sonnet, Google’s Gemini 1.5 Pro, and OpenAI’s GPT-4o, o1-preview, and o1-mini. They can either go with Copilot's default, or toggle between models during a conversation with Copilot Chat about the best model for particular use cases.

The move, announced at the GitHub Universe conference in San Francisco last week, aims to expand the variety of AI models to help cater to unique individual developer needs, according to GitHub CEO Thomas Dohmke.

"In 2024, we experienced a boom in high-quality large and small language models that each individually excel at different programming tasks. There is no one model to rule every scenario, and developers expect the agency to build with the models that work best for them," he said.

"It is clear the next phase of AI code generation will not only be defined by multi-model functionality, but by multi-model choice. Today, we deliver just that."

Anthropic’s Claude 3.5 Sonnet was made available via GitHub Copilot to coincide with the announcement, while Google’s Gemini 1.5 Pro will be made available for users in the coming weeks, the company confirmed.

"Claude 3.5 Sonnet excels at coding tasks and is broadly used by developers for its exceptional grasp of software engineering principles and ability to tackle complex programming challenges," said Jared Kaplan, co-founder and chief scientist at Anthropic.

"Through GitHub Copilot, Claude will help even more developers throughout the entire development process, from concept to deployment."

GitHub wants to simplify application development

This wasn’t the only major announcement from GitHub last week, either. The firm unveiled a new feature aimed at simplifying application development.

The new GitHub Spark feature uses natural language to build micro apps that can integrate AI features and external data sources without requiring any management of cloud resources.

Developers can start with an initial prompt using both OpenAI and Anthropic models, see live previews of their app as it's built, and automatically save versions of each iteration so they can compare versions as they go.

The new feature also gives developers the option to make changes directly to the underlying code.

"For too long, there has been an unscalable barrier of entry separating a vast majority of the world’s population from building software. This can change with GitHub Spark, our new AI native tool to build applications entirely in natural language," said Dohmke.

"With Spark, we will enable over one billion personal computer and mobile phone users to build and share their own micro apps directly on GitHub—the creator network for the age of AI."

The company also bolstered AI capabilities across its platform with the introduction of multi-file edit for GitHub Copilot in VS Code. This allows Copilot Chat in VS Code to be used to make edits across multiple files at the same time.

GitHub Copilot Extensions, meanwhile, will allow developers to ask questions of any integrated developer tool, including Atlassian Rovo, Docker, Sentry, and Stack Overflow. Users will also be able to build their own private extensions that work with their internal developer tooling.

Similarly, the code completion capabilities of Copilot are now available in public preview for Xcode, for building apps across all Apple platforms.

Over one-third (39%) of software developers have little to no trust in AI-generated code despite most admitting to using AI coding tools daily, new research shows.

Google’s ‘State of DevOps’ report found over 75% of surveyed developers use AI for at least one daily professional responsibility. Chief among use cases is code generation, with 74.9% using the technology to write code.

While over a third of respondents reported the productivity benefits of AI, many lack confidence in the code produced.

This low level of trust expressed by respondents indicates a need to manage AI integration more thoughtfully, the report said, and teams must ensure they evaluate AI’s role in workflows carefully to mitigate downsides.

It’s worth noting that the majority of those surveyed (87.9%) reported that they had at least some level of trust in AI-generated code.

There are also issues in software delivery performance. The increase in AI adoption was mirrored by an estimated 1.5% decrease in software delivery throughput, the report explained, along with an estimated 7.2% reduction in software delivery stability.

“Our data suggest that improving the development process does not automatically improve software delivery — at least not without proper adherence to the basics of successful software delivery, like small batch sizes and robust testing mechanisms,” it said.

The report suggested three recommendations on the back of its findings, such as the establishment of clear guidelines for AI use, addressing procedural concerns, and the assurance of open communication around AI impact.

Google added that businesses should encourage the exploration of AI tools and create time dedicated to AI experimentation.

Do AI coding tools cause more harm than good? 

Google’s research marks the latest in a string of studies exploring the benefits and potential pitfalls of AI coding tools, with developers flagging repeated concerns over code security and consistency.

A recent study from Black Duck Software aligns closely with Google’s study, highlighting growing distrust among developers with regard to AI-generated code quality.

The study, published earlier this month, found that around 90% of developers are using the technology in their daily workflows. However, less than one-quarter of respondents described themselves as ‘very confident’ in their organization’s policies and processes for testing AI-generated code.

Notably, issues with code quality were found to be slowing down development lifecycles due to the fact security testing practices had to be expanded to accommodate for potential inconsistencies.

Similar research from Gitclear found that AI-generated code can be often of a lower quality and is more difficult to maintain, while news earlier this year revealed code generated by GitHub Copilot could be dangerously flawed.

On the other hand, research from GitHub found software development teams created more secure software and better quality code through the use of AI coding tools.

Despite lingering concerns, research has highlighted the benefits of AI coding tools for developers globally. A study from GitHub in August found the use of AI coding tools has significantly improved productivity and helped reduce strain on developers.

A key benefit highlighted in the study was the time savings afforded by the use of AI tools, according to GitHub. Nearly half (47%) of respondents stated they’ve been able to free up more time to ramp up collaboration with peers and focus on system design, for example.

Other developers reported that the time savings afforded by AI tools has allowed them to learn new coding languages.

GitHub has unveiled a data residency feature for its Enterprise Cloud service that will allow users to control what regions their code is stored in.

The feature will be generally available in the European Union (EU) from October 29 to begin with, and GitHub confirmed the option will be made available to users in Australia, Asia, and Latin America in due course.

In the same way that many firms are now offering regional sovereign cloud choices for the storage and location of data, GitHub’s new offering will allow users to choose where code and repository data are stored.

Customers will also be given “enhanced user control,” allowing organizational management and control of different accounts as well as unique company-specific namespaces and increased availability for “zone-based” continuity and disaster recovery.

The move will help enterprise users fulfill security and compliance requirements, GitHub said, by handing over a greater level of control to code owners and developers.

"In light of the mounting importance of data residency needs, there is a clear desire for organizations to have more control over where their most valuable asset, their code, is stored,” GitHub CEO Thomas Dohmke said.

"The timing is crucial as organizations in the EU and across the world are racing to empower their software developers with AI at every step to get ahead and win in the global market,” he added.

GitHub’s move appears to have struck a similar chord with customers, with the firm including positive comments from some big-name users.

One such example was from Alexander Hanl, Product Manager for CI/CD environment at CARIAD, who noted that ensuring data is predominantly hosted in Europe was a priority for his company.

“By bringing data residency to GitHub Enterprise Cloud, we now have a valuable solution that aligns with our needs, marking a crucial first step in our plan to reduce our self-hosting efforts and empower our developers to build, deploy, and collaborate from the cloud as well,” Hanl said.

Data sovereignty is a hot topic

GitHub’s move towards code sovereignty comes after a year in which Microsoft, AWS, Oracle, and Rackspace all launched sovereign cloud services for regional data processing.

Microsoft did so in Europe to a customer base hungry for the change, with the move described as “a long time coming” by analysts. Mark Boost, CEO of Civo, told ITPro at the time that enterprise “data should have always been sovereign.”

Oracle has been more proactive in its push for sovereignty, with the firm’s executives touting the demand for sovereign cloud as well as Oracle’s well-placed position to provide for it at the firm’s recent Oracle CloudWorld 2024.

After AWS announced its €7.8 billion investment into AWS European Sovereign Cloud, experts told ITPro sovereign cloud offerings have become the “bare minimum” for businesses if they want to stay relevant.

Software development teams are beginning to see the value of AI coding tools, according to new research, with developers revealing the solutions have helped them learn new languages and save time.

GitHub surveyed 2,000 software engineers, developers, and programmers from the US, Brazil, Germany, and India, as well as a small number of data scientists and software designers.

Over 97% of respondents said they had used AI coding tools at work at some point, although some of these instances were not sanctioned by their companies.

GitHub noted that this year software development teams recognized more benefits with AI coding tools than previously reported. Developers using these solutions noted they were delivering more secure software, better code quality, improved test case generation, and faster adoption of new languages.

For example, 90% of the US respondents and 81% of those in India reported a perceived improvement in code quality when using AI tools, with 61% of those in Brazil and 60% in Germany stating the same.

There was virtually universal agreement that AI-enhanced coding tools would generate an overall improvement in code security across the board.

In addition, the majority of development teams expressed optimism about the potential of these  tools to moderately improve or significantly enhance their ability to meet customer requirements

Although the extent of this optimism was associated with the stance of the respondent’s firm on AI use in software development. 

The level of optimism developers had for how AI tools could improve their workflow was linked to their organization’s stance towards AI more generally, however. GitHub found staff from firms that were actively encouraging AI adoption were more likely to express confidence in the technology, the results showed.

This suggests firms that are more supportive of AI could help their employees maximize the potential value they can unlock using the new technology.

Time savings, in particular, are helping development teams focus their energies elsewhere, GitHub found, with 47% of respondents in the US and Germany stating they used the saved time for collaboration and system design.

Productivity gains and time savings to be had with AI coding tools

GitHub’s findings corroborate similar investigations looking into how AI is shaping the development process. Stack Overflow’s 2024 Developer Survey found there is increased appetite for AI coding tools this year. 

76% of respondents said they are using or planning on using AI tools in their development process, up from 70% in 2023.

Almost three-quarters of respondents (72%) were favorable or very favorable toward the use of AI in code development, with 81% agreeing productivity is the biggest benefit to AI tooling. Speeding up learning was identified as another major benefit for developers learning to code (71%) as well as established professional developers too (61%).

Speaking to ITPro, Angus Allan, senior product manager at CreateFuture (formerly xDesign), said GitHub’s findings align with his company’s experiences, describing the productivity gains from adopting AI coding tools as “substantial”.

“In our internal experiments, we observed a 33% average increase in productivity across various roles in the software development life cycle. A similar productivity increase was observed by our product team in non-coding activities, indicating that generative AI tools have broad applicability for teams building software products,” he explained.

“With our findings aligning approximately with earlier studies, it has given us confidence that GenAI has a real, tangible impact on productivity if harnessed correctly.”

Allan argued that although productivity gains are evident, the true value AI tools can unlock for businesses comes in the time developers can save, which can be reallocated on more activities that add more value to the organization, such as better collaboration.

“The real value from GenAI tooling hasn't just been the pure productivity benefits, but what we do with the extra time saved in the development process. As a firm, we have been encouraging staff to see GenAI as a tool in their toolbox that enables them to spend more time on ‘value-add’ activities, such as collaboration, talking to customers, and coaching junior team members,” he stated.

“If a firm deploys AI technology without an understanding and guidance on what teams should do with any extra time they save in the development process, they will be missing out on an enormous opportunity for GenAI to be the enabler of innovation and collaboration.”

Hesitant firms’ staff more likely to distrust AI tools

One key finding from GitHub’s research indicated that the way an organization promotes using AI coding tools can have a significant impact on staff perception.

For instance, 48% of those working in companies that actively promoted the use of AI tools said their toolchains were ‘simple to use’, compared to 65% of those working in organizations with a neutral stance on AI, who described their toolchains as ‘complex’.

Allan noted that CreateFuture also found there was a link between an organization’s stance on AI and how developers viewed the tools.

“The correlation between organizational AI stance and developer experience is noteworthy. In our experiments, we found that productivity gains increased over time as we enhanced training, built specific GenAI workflows, and saw broader technology adoption.”

GitHub is set on eliminating insecure code with its new offering, Copilot Autofix, a tool designed to automate dealing with software vulnerabilities. 

Using AI, Autofix analyzes vulnerabilities in code, describes the importance of said vulnerabilities, and then presents users with suggestions to help developers fix each issue as it arises. 

GitHub found that developers were able to fix software vulnerabilities at more than three-times the speed of those attempting to fix issues manually when they trialed the platform as part of a public beta.  

Fixes for cross-site scripting vulnerabilities were seven times faster, taking 22 minutes with Autofix compared to nearly three (2.8) hours manually. For SQL injection vulnerabilities, fixes were 12 times faster at 18 minutes compared to 3.7 hours. 

The firm described the tool as “a powerful example of how AI agents can radically simplify and accelerate secure software development.”

"Since implementing Copilot Autofix, we've observed a 60% reduction in the time spent on security-related code reviews and a 25% increase in overall development productivity," said Kevin Cooper, principal engineer at Optum. 

During the beta, which began in March 2024, Developers used Autofix in their pull requests to help them rapidly and efficiently fix issues in new code before it was fed to production and risked interaction with end users. 

Autofix can generate fixes for “dozens of classes of code vulnerabilities”, like SQL injection or cross-site scripting. Developers can choose what to do with fixes in their pull requests and can decide whether they want to dismiss, edit, or commit them.

How to use GitHub’s Copilot Autofix

To use the tool, users need to press the “Generate fix” button in the GitHub Advanced Security (GHAS) code-scanning alert. Thereafter, Copilot Autofix sets about analyzing the code for vulnerabilities. 

Once a code solution is returned, the developer can press “create PR with fix” to create a new pull request that includes the relevant code fixes, allowing teams to “pay down years’ worth of security debt … in just a matter of a few clicks.”

"Copilot Autofix takes care of cumbersome security tasks, ensuring our existing and new code is always as secure as possible,” Mario Landgraf, Community Manager, Security at Otto, said. 

“Vulnerabilities are flagged immediately and code changes are recommended automatically. It helps our teams to free up time so they can focus on more strategic initiatives,” he added. 

A leaked GitHub access token with administrator access to the centralized PyPI repository and the Python Software Foundation’s GitHub repository could have had disastrous consequences if not rapidly revoked.

Researchers at JFrog revealed the leaked token could have been used in a variety of different supply chain attacks, adding that the potential damage a cyber criminal could have inflicted would have been severe.

JFrog’s secret scanning engine found the authentication token in a compiled Python file inside a Docker container. 

Speaking to ITPro, Brian Moussalli, malware research team leader at JFrog, noted this is something of a novel development and he had not seen access tokens leaked in this manner before.

“I’m not aware of any similar cases where tokens with such high privileges were leaked on a public repository," he said. "I think there were cases where tokens were leaked as part of distributed software, but in this case it was some sort of accident that happened due to the developer or PyPI admin developing some sort of internal tool for the deployment of PyPI servers and they uploaded it to Docker Hub for some reason."

“What happened is that they used the token in the source code and they ran it, and then when they uploaded it to Docker Hub they thought they had removed all traces to the sensitive token but, in fact, it was found in a binary file, which is produced after executing the actual code. So I don’t remember any such case where a leak happened as some byproduct of someone’s internal work.”

David Sancho, senior threat researcher at Trend Micro, added that the software supply chain has seen a number of attacks leveraging malicious software updates to install malware on millions of devices, such as the NotPetya or SolarWinds attacks. 

However, the overall popularity of this attack is limited by its complexity.

“This attack vector is not something we’re seeing commonly pursued because it’s very difficult to pull off, but it’s certainly very interesting to would-be attackers and on their radar as an appealing route to compromise organizations.”

Leaked GitHub access token provided “endless” opportunities for attackers

The report underlined how serious this incident could have been if successfully exploited by hackers. 

“Due to the popularity of Python, inserting malicious code that would eventually end up in Python’s distributables could mean spreading your backdoor to tens of millions of machines worldwide!”

JFrog highlighted one potential attack path involving hiding malicious code in CPython, the repository containing many of the basic libraries at the core of the Python programming language, compiled from C code.

This malicious insertion could then be packed and distributed in various forms to official Python binaries, upstream for Linux distribution packages such as Ubuntu or Alpine, or to people developers from source code tarballs.

In another example, JFrog raised another potential attack vector where hackers insert malicious code into PyPI’s Warehouse code, which underpins the PyPI package manager.

“Imagine an attacker inserting code that grants them a backdoor to PyPI’s storage, allowing them to manipulate very popular PyPI packages, hiding malicious code inside them, or replacing them altogether. Although this is not the most sophisticated way to carry out an attack that would remain undetected for a long time, it’s certainly a scary scenario.”

Moussalli concluded the token would have presented hackers with numerous opportunities to perpetrate further cyber attacks. 

“If someone were to put a backdoor on PyPI, the possibilities are endless in terms of distributing malicious packages. I could have replaced all the popular packages on PyPI with a malicious package with some sort of backdoor or Trojan or whatever,” he added.

So one direction could be the Python language itself, and the other would be the Python packages index where I could have attacked any given package.”

PyPI’s quick response “crucial” to prevent disaster

JFrog commended PyPI for the urgency with which it addressed the issue, taking just 17 minutes to revoke the token after JFrog reached out to them. 

It noted that the organization conducted a “thorough check” and found there was no suspicious activity using the token in question. 

Moussalli described the importance of responding to incidents of this scale in a timely manner.

“I think there’s no other word to describe it other than crucial. It’s crucial that they would be quick to respond and assess whether or not they have been impacted and if anyone tried or succeeded in using this token, auditing, going over logs to see if it was used and if some perpetrator was able to take advantage of this leak.”

GitHub is aiming to make AI models more accessible to developers with the launch of GitHub Models.

The new feature gives free access to AI models including Meta's Llama 3.1, OpenAI's GPT-4o and GPT-4o mini, Cohere's Command, and Mistral AI's Mistral Large 2, directly in GitHub.

This, GitHub said, will allow developers to try out and compare the capabilities of the various different models directly within GitHub Codespaces or Visual Studio Code, and then integrate generative AI models into their own applications.

The aim is to make it simpler for developers to explore different AI models in an interactive playground and develop code using their existing GitHub identity.

"With GitHub Models, more than 100 million developers can now access and experiment with new AI models where their workflow is — directly on GitHub," said GitHub CEO Thomas Dohmke.

"From OSS repositories to Copilot Extensions to GitHub Models, it is intentional that we bring as many partners into GitHub as possible. The world’s developers deserve to build with a wide array of world class AI."

How devs can use GitHub Models

Once developers have tried out the different models and like what they see, GitHub has created a 'glide path' to bring the models to their developer environment in Codespaces and VS Code. 

When they're ready to go to production they can access an Azure software development kit (SDK) to connect to Azure AI.

The Azure AI Inference SDK provides client libraries in Python and JavaScript, with support for C# and .NET coming soon. Microsoft said SDK makes it easy to integrate AI into applications by simplifying common tasks related to authentication and security, and retries in a variety of programming languages.

"We’re proud to be an early part of GitHub Models, enabling more developers to interact with and utilize Cohere’s technology through Azure to power and inspire more applications that solve real-world problems," said Aidan Gomez, CEO and co-founder of Cohere. "GitHub and Microsoft are key partners to us in bringing AI solutions to all."

GitHub claims that its Copilot is by far the most widely adopted AI-powered developer tool, with more than 77,000 organizations – from BBVA, FedEx, and H&M to Infosys and Paytm – having adopted Copilot in the last two years. It accounted for over 40% of GitHub’s revenue growth this year.

A number of organizations have already been testing GitHub Models.

"As an AI start-up founder and open source maintainer, GitHub Models enables my team to access and experiment with various LLMs in one place," said Anand Chowdhary, co-founder of FirstQuadrant. "This streamlines our development and lowers the entry barrier for building AI apps."

GitHub said that as time goes on, it plans to add more models to its platform.

Mistral AI has unveiled the launch of ‘Codestral’, its first generative AI coding assistant designed specifically to support developers. 

The Microsoft-backed French startup said the new AI tool has been trained on over 80 programming languages, including Java, Python, JavaScript, and C++.

Codestral “also performs well” on more specific programming languages, Mistral said, including Swift and Fortran.

“This broad language base ensures Codestral can assist developers in various coding environments and projects,” the firm said in a blog post.

Like other code generation tools on the market, such as Code Llama, GitHub Copilot, or Amazon Q Developer (formerly CodeWhisperer) Mistral’s tool enables developers to write and generate code.

The tool can complete coding functions, write tests, and complete “any partial code using a fill-in-the-middle mechanism”, the company said.

“Interacting with Codestral will help level up the developer’s coding game and reduce the risk of error and bugs.”

The new model also boasts impressive performance metrics, coming in as a 22B parameter model. Mistral said this sets a new standard on performance and latency for code generation compared to other models currently available on the market, including the Code Llama 70B model.

Is Mistral AI's Codestral model open source?

Mistral described Codestral as an “open-weight” generative AI model in its blog post, meaning it’s not strictly ‘open source’ by most definitions. 

This has been a contentious topic in the AI space in recent months, with some industry stakeholders noting that major firms such as Meta, for example, have framed their models and tools as open source while still restricting commercial use.

Codestral is licensed under the new Mistral AI Non-Production License, which the company said can be used for “research and testing purposes”. This means that it can’t be used openly for commercial purposes.

“This license allows developers to use our technology for non-commercial purposes and to support research work,” the firm said in a blog post outlining the licensing terms. “It ensures that those who build a business based on our work do so in a fair and sustainable way for all parties.”

Mistral said that this new license “strikes the right balance between our commitment to openness principles and our responsibility to grow our business”.

The firm added that it will still continue releasing models and code under Apache 2.0 licensing.

Codestral has some serious competition

Codestral’s launch marks Mistral’s first serious foray into the coding assistant space, pitting it against a raft of major industry heavyweights such as GitHub, AWS, and Meta. 

Since the advent of generative AI in late 2022, one of the leading use cases for the technology touted by providers has been support for developers to improve productivity and alleviate strain placed on development teams.

Research on the topic shows that developers are keen on these tools, with a study from GitHub last year revealing that users can complete tasks 55% faster using an AI assistant.

The use of AI assistants also helps improve workflows and reduces developer toil, the study found, further improving overall productivity.

Research has shown some major pitfalls, however. A study from GitClear earlier this year found “disconcerting trends” in terms of reliability and accuracy.

GitClear examined more than 150 million lines of code written between January 2020 and December 2023 to see if it could spot code quality differences as a result of AI coding assistants. The results were far from exemplary and uncovered a sharp increase in ‘code churn’.

GitHub’s new ‘Copilot Extensions’ offering promises to deal with a common thorn in the side of developers known as ‘context switching’, a term used to express the psychological strain placed on staff who are forced to jump from one task to another. 

When developers move from one task to another, or one environment to another, they are liable to lose focus, experts told ITPro, adding to workloads and affecting overall productivity rates. 

GitHub’s new offering, unveiled at Microsoft’s Build conference this week, will centralize tools and services in an effort to minimize this strain, ensuring that developers avoid burnout when completing tasks across various ecosystems and architectures.

Copilot Extensions will enable developers to build and deploy to the cloud in natural language with their “preferred tools and services” without having to leave the integrated development environment (IDE) or GitHub itself.

The offering integrates with a variety of different platforms, including DataStax, Docker, Microsoft Azure and Teams, MongoDB, Pangea, Pinecone, Product Science, and a few others. 

In the announcement, GitHub asked prospective users or readers to imagine the struggle faced by a developer who needs to, for example, deal with an issue that requires working in numerous environments.

“With enough context, you start troubleshooting what could be the cause, going to tools like Sentry for error monitoring to learn more. Then, you have to figure out a solution, apply the fix, and then deploy with Azure. In this scenario, there is a lot of context-switching,” GitHub said. 

The firm then claims that its new product will solve the issues presented in this common scenario by essentially bringing the “whole process together” and consolidating these tools into one system.

Dom Couldwell, head of field engineering EMEA at DataStax, one of the Copilot Extension partners, told ITPro that this could play a key role in helping reduce the strain of context switching for developers. 

“If you find yourself constantly switching from meetings to coding, or to looking at different kinds of coding and back again, then it can be hard to get into that productive mindset and stay there,” Couldwell said. 

“The Copilot approach aims to help developers work around different areas in coding and development in one place. This makes it easier to avoid context switching overhead, because developers can work in the way that suits them rather than having to switch between different ways of thinking about problems,” he added.  

Context switching significantly undermines productivity 

Context switching has been a pain point in development for years, with research from as far back as 2018 detailing how it causes problems by breaking up workflows and leaving projects unattended.

“We found that developers switch about two-thirds (59%) of their daily tasks from which 40% require context switching, and they never resume 29% of their interrupted/switched tasks,” the research stated.

The report also suggested that developer work sessions are often “fragmented into many short sessions” of between 15 and 30 minutes, with the average programmer spending similar amounts of time “reconstructing working context before resuming interrupted tasks”.

GitHub is building on the success of its existing Copilot offering with the release of a technical preview for ‘GitHub Copilot Workspace’, a comprehensive code development ecosystem built to aid developers. 

In Copilot Workspace, developers are able to utilize generative AI to assist them in every stage of the development lifecycle, the company revealed, from brainstorming and ideation to planning, building, testing, and ultimately running code. 

As with GitHub Copilot, all of these processes are performed in natural language, giving users a “task-centric experience” that leverages different Copilot agents throughout different development processes. 

“We are reimagining the nature of the developer experience itself,” CEO of GitHub Thomas Dohmke said. “Copilot Workspace represents a radically new way of building software with natural language.”

The tool is designed to enhance developer creativity and not to replace it, Dohmke added, noting that the platform aims to “empower” experienced developers while simultaneously lowering barriers to entry for new coders. 

Though the company shared a glimpse of this product at the GitHub Universe conference in 2023, GitHub now has a more concrete preview to share with the world, fit with demonstrable features and functions.  

GitHub Copilot Workspace has developer workflow at its core 

GitHub’s new workspace offering strives to be present at every stage in the development process, the company said, from the beginning of an idea to the finalization of a project. 

As such, Workspace claims to meet developers “right at the origin”, a GitHub Repository or a GitHub Issue, levering Copilot agents to assist developers in getting through the initial stages of development.  

“For developers, the greatest barrier to entry is almost always at the beginning. Think of how often you hit a wall in the first steps of a big project, feature request, or even bug report, simply because you don’t know how to get started,” Dohmke said.

Copilot Workspace can then assist the user in creating a plan by leveraging its “deep” understanding of the codebase, providing a developer with the necessary tools to validate the plan and test the code. 

The plan is created in natural language and is entirely editable, giving developers the option to make adjustments and check them within the workspace. 

“All that’s left then is to file your pull request, run your GitHub Actions, security code scanning, and ask your team members for human code review,” Dohmke said.

Integration and collaboration are key to Workspace 

GitHub places the focus of its offering on inter-team collaboration and user integration into the wider GitHub community.

Developers can, for example, collaboratively share workspaces with their team members through a link. Other members of the team can then analyze a developer's workflow as well as offer their own contributions or suggestions. 

GitHub itself is also already a popular environment for developers, and the firm said it’s accelerating to a future where “one billion people on GitHub will control a machine just as easily as they ride a bicycle”.

Copilot Workspace is therefore built into a huge and ever-growing community of existing developers, offering integration to those who want a seamless experience across both their AI code assistant and their developer community. 

In a similar vein, Copilot Workspace is mobile-compatible, allowing developers an even further level of workflow integration.

“This is our mark on the future of the development environment: an intuitive, Copilot-powered infrastructure that makes it easier to get started, to learn, and ultimately to execute,” Dohmke said.

Cyber criminals are using the comment section for popular repositories hosted on GitHub and GitLab to trick developers into downloading malware onto their systems.

The latest in a string of novel techniques used by threat actors to distribute malware via Git repositories, hackers once again rely on the reputation of trustworthy sources like Microsoft and Nvidia to sideload their malicious code onto developer systems.

The process involves abusing the file upload logic in GitHub’s comments, using the system to automatically generate download links using the name of the owner of the repository, regardless of the commentor’s identity or content of the file itself.

Sergei Frankfoff, co-founder of automated malware analysis company Open Analysis, first highlighted the issue in a livestream on 27 March 2024, in which he claimed threat actors were already actively exploiting the flaw.

On 17 April 2024, security company McAfee released a report on the Redline Stealer trojan that leveraged a LUA malware loader to deliver the malicious payload. 

The report noted that the LUA loader was distributed through a seemingly legitimate Microsoft GitHub repository, concluding that GitHub was being abused to host the malware at Microsoft’s official account under the vcpkg repository.

But upon further inspection by a separate publication, the source code for vcpkg repository – containing Microsoft’s C++ Library Manager for Windows, Linux, and MacOS – included no reference to the files.

Instead, hackers found a way of using the comment section underneath the repository to upload files which GitHub then links to the official Microsoft repository.

When users leave a comment on GitHub, they can choose to attach a file which is then uploaded to GitHub’s content delivery network (CDN) and linked to the project the comment was made on.

GitHub automatically generates a download link for the file, and the unique URL uses the name of the legitimate repository the comment was attached to, lending the link more credibility.

Because GitHub automatically generates the download link as soon as the file is attached to the comment, the hackers trying to evade detection can delete the comment as soon as the file is uploaded and their comment will disappear but the file will continue to be hosted at that repository.

As a result, mitigation steps are limited to unilaterally disabling comments on your repository, which for smaller maintainers might risk damaging their reputation or trustworthiness.

Frankoff noted in March that it appeared GitHub was trying to mitigate the issue by restricting the file types users can upload via the comment function, but warned ZIP files, often used to conceal malware, were still allowed.

Furthermore, GitLab also has a similar mechanism that automatically generates download URLs for files attached to comments, indicating hackers could apply this approach to similar developer platforms.

GitHub repositories have become a happy hunting ground for cyber criminals

This technique follows a string of similar cases where threat actors use platforms like GitHub to target developers with malware.

One such instance involved hackers abusing GitHub’s search function to trick developers into downloading malicious code. The attackers used the names of popular GitHub repositories to disguise malware.

The threat actors were observed using a number of GitHub features, such as its automation tool GitHub Action, to artificially push their fake repositories up the search results and promote their malware.

Hackers have also been recorded taking advantage of AI hallucinations by popular chatbots to distribute their malware via GitHub. 

Researchers at Lasso Security found ChatGPT frequently recommends code libraries that don’t actually exist.

A follow-up to the initial investigation warned that threat actors had picked up on this tendency and were uploading malware using the names of the frequently hallucinated packages in the hopes a developer might uncritically recommend the package by an AI agent.

The investigation revealed a dummy package created using the name of a fake Hugging Face package frequently hallucinated by ChatGPT received over 30,000 authentic downloads in only three months, illustrating how effective this technique could be.

Max Gannon, cyber intelligence team manager at email security specialist Cofense, said the lack of available mitigation measures for the flaw and the obfuscation baked into the approach makes the issue difficult to resolve.

“This is a very clever tactic for threat actors to take advantage of, especially because GitHub has really provided no way for companies to mitigate the threat. The only thing that can be done is for individuals to exercise caution when clicking any link, regardless of where it appears to go or who it appears to be from,” he said. 

“For example, if you stopped and thought about it, a .zip file containing cheat software is not likely to be directly hosted on a Microsoft repository."

GitLab has announced the general availability of its coding assistant GitLab Duo Chat, as it aims to challenge GitHub Copilot in the AI pair programming space.

Duo Chat brings together GitLab’s Duo suite of AI capabilities into one natural language chat interface.

GitLab launched its Duo Suite in June 2023, promising a range of new features to assist DevSecOps teams, including code suggestions, vulnerability descriptions, issue summaries, and more. 

The company said these features would all become available via Duo Chat over the course of 2023, which was made available in beta in November that year.

Duo Chat is now generally available within the GitLab user interface, including GitLab’s Web IDE, as well as inside other popular IDEs such as VS Code and the JetBrains suite of developer environments.

Alongside the rollout of Duo Chat, GitLab announced it would be making three GitLab Duo capabilities generally available alongside the chat interface. These include helping devs parse code explanations, refactoring, and test generation. 

These features will help users parse unfamiliar code snippets, modernize existing code, and automate test writing, which it said will enable developers to identify and remediate bugs quicker.

In an announcement, GitLab said Duo Chat will be particularly useful for developers undergoing onboarding, where devs can get help with general knowledge questions such as how to get started with popular frameworks or how to reset their GitLab password.

However, the company stressed that all of the Duo AI features will be available with access controls so that organizations have total control over sensitive data at the project, sub-group, and group level.

Duo Chat is available as part of GitLat Duo Pro, which users can purchase for $19 per user per month.

GitLab Duo Chat is well placed to catch developers’ interest

GitLab Duo Chat enters a relatively crowded market with GitHub Copilot, Amazon CodeWhisperer, and Gemini Code Assist, all of which are already available for users to try.

A survey conducted by Gartner found 63% of organizations were piloting, deploying, or had already deployed AI coding assistants by Q3 2023. This marks a drastic increase in demand for these tools, compared to the 10% of devs that were using coding assistants at the beginning of 2023. 

As such, the race is on to become the pair programming assistant of choice, and GitLab Duo Chat has its work cut out for it, with competing solutions with hyperscaler backing getting a head start in the market. 

GitHub Copilot was made generally available in February 2023, and gained over 1 million paid subscribers across more than 37,000 organizations by October 2023, according to Microsoft CEO Satya Nadella.

Speaking to ITPro, Martin Røed, CTO & co-founder at AI software company Databutton, said GitLab – like GitHub – is in a good position to get a lot of users adopting its new chatbot quickly as it is meeting developers where they are, integrating Duo Chat their preexisting workstream.

“As a one-stop-shop development platform, GitLab has a unique relationship with its developers and their workflows, very similar to GitHub. GitLab’s potential to radically improve the more complex and difficult part of their workflow with LLMs is very appealing as they can integrate it fully into their stack.”

Technically, GitLab Duo Chat appears to be on a par with GitHub Copilot, according to Røed, but how the models are adapted over the next few years will be the real indicator of their success.

“The Duo Chat is largely using the Claude 2 model from Anthropic. If they don't already, I'm sure they'll also leverage the Claude 3 Opus model in cases where it makes sense; this is a very similar model-set from a technical-spec point of view as to what GitHub Copilot is using (GPT 3-4). The biggest differences will very likely come from how they evolve their chat agents over time.”

When asked about how he thinks GitLab’s solution will compete with GitHub Copilot, Røed was optimistic despite Copilot’s sizable head start in the code assistant space.

He noted the field remains relatively immature, speculating that the solution that is best integrated into existing developer tools will offer the most value to businesses.

“Similarly to how the code repository space is not a winner-takes-all, there's room for more than one player in the code-generation space for developers. Despite code generation being the most widely adopted LLM use case for now (with customer support being a good second), it's important to remember that we're still in the early phase of integrating this technology into the real world," he explained.

“As we move past benchmarks and the ‘best’ raw LLMs, the real gain will be how they are integrated into their existing suite of tools, and how much it will enhance the real-world development flow.”

Hackers are using the names of popular GitHub repositories to trick users into downloading malicious code, new research reveals.

Analysis from Checkmarx found cyber criminals are abusing GitHub’s search functionality to trick unsuspecting devs into loading malware onto their systems.

The report’s author, Checkmarx research engineer Yehuda Gelb, detailed how hackers use a series of techniques to artificially inflate the popularity of their fake repositories to push them further up GitHub search results.

The first of these involves leveraging the platform’s automation tool, GitHub Action, to frequently update the malicious repositories, making very minor tweaks to a log file or by updating the date or time, for example.

This activity on the repository boosts its visibility, particularly if developers choose to filter their search by those most recently updated  – a common choice for devs who want to ensure the code is properly maintained.

Attackers were also observed creating multiple fake accounts in order to promote their own malicious repositories, adding fake stars in an attempt to make the asset seem more trustworthy.

Gelb noted that this investigation found attackers had become more subtle in their attempts to push their fake repos on devs, learning from previous cases where attackers were easily identifiable by the sheer amount of churn their fake activity was creating.

“In contrast to past incidents where attackers were found to add hundreds or thousands of stars to their repos, it appears that in these cases, the attackers opted for a more modest number of stars, probably to avoid raising suspicion with an exaggerated number”, Gelb explained.

“This social engineering technique is designed to manipulate users into believing that the repository is widely used and reliable, preying on the inherent trust users place in highly-starred repositories.”

GitHub users should be wary of suspicious Visual Studio project files

The malicious code used in these attacks is often concealed within Visual Studio project files in order to evade detection, the study found, which executes automatically when the project is built.

Unless users explicitly search the repository for suspicious elements they won’t notice the dubious files, the report noted.

Interestingly, the PowerShell script contained in the malware retrieves the country code of the target machine’s IP address in order to determine if the victim is based in Russia. 

Based on where the victim is located, the payload downloaded onto the machine is different, suggesting the attackers could be located in Russia and tailoring their attacks to avoid impacting domestic entities, and reduce any unwanted attention from the state’s authorities.

The report includes advice on some indicators of compromise (IoC), including whether the repository in question has received complaints through the GitHub Issues feature, or pull requests from devs who experienced problems after downloading and deploying the code.

Gelb recommended developers scrutinize any repositories more closely, paying attention to the commit frequency. 

For example, does the repository have an incredible number of commits compared to how long it has been available on the platform? Or are these modifications only changing one file with minor edits?

Gelb also advised users to investigate the accounts that have starred the repository they are considering using, paying particular attention to how long these accounts have been active and whether this matches other accounts who have starred the repository.

All of these indicators should warn developers to exercise caution before downloading and executing the code, according to Gelb, who argued that the recent XZ attack should be enough evidence to show relying on reputation is not enough for meaningful supply chain security.

“In the aftermath of the XZ attack and many other recent incidents, it would be irresponsible for developers to rely solely on reputation as a metric when using open source code”, Gelb wrote.

“A developer who blindly takes code also blindly takes responsibility for that code. These incidents highlight the necessity for manual code reviews or the use of specialized tools that perform thorough code inspections for malware. Merely checking for known vulnerabilities is insufficient.”

AI hallucinations have opened a potential path for hackers to deliver malicious packages into the repositories of large organizations, new research shows.

The claims, made by Lasso Security researcher Bar Lanyado, follow a 2023 investigation into whether package recommendations given by ChatGPT should be trusted by developers.

In June 2023, Lanyado found LLMs were frequently hallucinating when asked to recommend code libraries, suggesting developers download packages that don’t actually exist.

Lanyado warned this flaw could have a wide impact as a large portion of developers are starting to use AI chatbots over traditional search engines to research coding solutions.

This initial investigation, since updated in a follow-up probe, sheds further light on the growing scale of the problem and warned that threat actors are picking up on this trend to create malicious packages using names that are frequently hallucinated by the models. 

The research paper advised developers to only download from vetted libraries to avoid installing malicious code.

Lanyado stated that his aim with this latest study was to ascertain whether the model makers have dealt with issues he highlighted in August last year, or if package hallucinations remain a problem six months after his initial findings.

One of the most stark findings from this latest study related to a hallucinated python package repeatedly dreamt up by a number of models called ‘huggingface-cli’.

Researchers uploaded an empty package with the same name to gauge whether these were being uncritically downloaded to repositories by developers using coding assistants.

He also included a dummy package to verify how many downloads were by real people, or just scanners.

Lanyado found the fake Hugging Face package received over 30,000 authentic downloads in just three months, demonstrating the scale of the problem around relying on LLMs for development work.

Searching GitHub to see if the package had been added in any enterprise repositories, Lanyado found several large companies either use or recommend the package in their codebase.

One example involved Chinese multinational Alibaba, which provides instructions for installing the fake python package in the README of a repository dedicated to inhouse company research.

Almost one-in-three questions elicited one or more AI hallucinations

In his initial study, Lanyado used 457 questions on over 40 subjects in two programming languages to test the reliability of GPT-3.5 turbo’s suggestions.

Lanyado found that just under 30% of questions elicited at least one hallucinated package from the model. The latest research has an expanded scope in terms of the questions he puts to the models, as well as the number of programming languages he tested.

Researchers also tested a number of different models including GPT-3.5 and 4, Google’s Gemini Pro, and Cohere’s Command, comparing performance and looking for overlaps where hallucinated packages were received in more than one model.

The latest investigation used 2,500 questions on 100 subjects in 5 different programming languages including Python, node.js, go, .net, and ruby. 

Lanyado’s prompts were optimized to simulate the workflow of software developers, using ‘how to’ questions to get the model to provide a solution that includes a specific package.

One other alteration made to the study was to use the Langchain application development framework to take care of the interactions with the models.

The benefit of this is using the system’s default prompt that instructs the model to say if it doesn’t know the answer, which he hoped would make the LLMs hallucinate less often.

The investigation found the frequency of hallucinations varied between models, with GPT-3.5 being the least likely to generate fake packages with a hallucination rate of 22.2%.

Not too far behind were GPT-4 (24.2%) and Cohere (29.1%), but by far the least reliable model in Lanyado’s testing was Gemini, which dreamed up code packages 64.5%.

GitHub is introducing a new code scanning autofix tool which can hunt down vulnerabilities in software code in a bid to support developers and ramp up productivity.

The new feature will be available from today in public beta for all GitHub Advanced Security customers, the company confirmed.

Powered by GitHub Copilot and CodeQL, the tool covers more than 90% of alert types in JavaScript, Typescript, Java, and Python programming languages, and can deliver code suggestions that remediate vulnerabilities “with little or no editing”.

CodeQL is the semantic code analysis engine developed by GitHub to automate security checks, and treats code like data, allowing developers to find potential vulnerabilities in code with greater confidence than traditional static analyzers.

Code security scanning tools help to identify vulnerabilities in code, but fixing them involve triaging alerts and checking documentation before working out the fix – all of which can take extra time.

GitHub said the code scanning autofix tool provides developers with an explanation of the problem and code suggestions to remediate it directly in the pull request.

It can explain what feature is causing the flaw, such as ‘user-provided response is directly used in HTTP response without any sanitization’ and then provide a detailed answer on why that is a problem.

The tool can then suggest a fix, offering a preview of the code suggestion that the developer can accept, edit, or dismiss.

Code suggestions can include changes to multiple files and the dependencies that should be added to the project, the firm said. Code scanning autofix uses the CodeQL engine and a combination of heuristics and GitHub Copilot APIs to generate these suggestions.

GitHub: “Code scanning autofix is the next leap forward” for developers

GitHub said that its GitHub Advanced Security offering helps teams remediate seven times faster than traditional security tools. 

“Code scanning autofix is the next leap forward, helping developers dramatically reduce time and effort spent on remediation,” the firm said.

Most organizations admit to an “ever-growing” number of vulnerabilities that exist in production repositories, it added. With the launch of the new tool, GitHub said developers will be able to directly tackle 'security debt' and make it easier to fix vulnerabilities as they code.

“Just as GitHub Copilot relieves developers of tedious and repetitive tasks, code scanning autofix will help development teams reclaim time formerly spent on remediation.”

The company further noted that security teams will also benefit from a reduced volume of everyday vulnerabilities.

What next for code scanning autofix?

GitHub said it plans to add support for more programming languages, with C# and Go “up next”.

GitHub Copilot has been one of the most high-profile examples of the rise of generative AI, offering code suggestions to make developers more productive (even if such tools might create more ‘software churn’). More than 50,000 businesses are using GitHub Copilot.

Last month GitHub Copilot Enterprise, aimed at developers in large organizations reached general availability. The enterprise tier includes chat tools personalized to an enterprise’s own codebase, plus documentation search and pull request summaries.

GitHub has announced it is enabling push protection for all users by default for all public repositories to help reduce accidental information leaks.

With push protections in place, GitHub will scan each ‘git push’ to a public repository to confirm there are no API keys, tokens, and other secrets that could be exposed as a result.

GitHub trialed push protection in April 2022 and the system has been in public beta since, with the firm making the secret scanning feature generally available in May 2023.

In a blog post announcing the change, GitHub said its secret scanning tool “guards over 200 token types and patterns from more than 180 service providers”.

With secret scanning push protection turned on by default, if a secret is detected in a push to a public repository, users will be able to remove it from commits, or ignore the warning and circumvent the block altogether.

Users can also choose to disable the feature entirely, although this is not recommended by GitHub.

GitHub said it might take a week or so for the changes to apply to all accounts, but users can verify their status and choose to opt-in early by going into their code security and analysis settings

GitHub deals with “more than a dozen accidental leaks every minute”

Eric Tooley and Courtney Claessens at GitHub explained inadvertent leaking of API keys, tokens, private keys, and credentials remains a pervasive issue, and one that has previously led to serious security breaches, reputational damage, and legal trouble.

“In just the first eight weeks of 2024, GitHub has detected over 1 million leaked secrets on public repositories. That’s more than a dozen accidental leaks every minute.”

Demand for a tool to bolster protections on pushes is high, according to the firm, which reported that since rolling the feature out to its Advanced Security customers, more than 95% of users choose to scan pushes to private repositories.

When it introduced the secret scanning feature in April 2022, GitHub said it detected over 200,000 secrets across thousands of private repositories using the tool.

Now, GitHub is looking to do the same for open source code and secure public repositories too. 

Vulnerabilities in open source code have increased significantly, according to new research from EDA specialists Synopsys.

Synopsys’ report revealed almost three quarters of all codebases assessed in 2023 were found to contain high-risk open source vulnerabilities, up 54% compared to the previous year.

The US National Institute of Standards and Technology (NIST) recognized the threat that exists in the software supply chain with new guidance on how organizations can protect themselves.

The new guidance stated that security teams should approve the merging of unverified sources of open source software, and that devs should try to download open source code as source code instead of pre-compiled libraries.

GitHub itself has struggled with accidental leaks in the past. In March 2023, the developer platform was forced to make changes to its terminal code and replace its RSA SSH host key after it was inadvertently exposed. 

GitHub Copilot Enterprise, an AI coding assistant aimed at developers in large organizations, has now reached general availability, featuring chat tools personalized to an enterprise’s own codebase, plus documentation search and pull request summaries.

By connecting Copilot Chat to repositories on GitHub, Copilot Enterprise allows developers to quickly get up to speed on the corporate codebase, search through and build documentation, get suggestions based on internal and private code, and quickly review pull requests, the company said.

This is the third version of the coding copilot to arrive. The first version of GitHub Copilot hit general availability in June 2022 after a technical preview the year before. In February, 2023 GitHub Copilot for Business arrived, adding more powerful AI models and additional security to filter out insecure code suggestions.

More than 50,000 organizations are now using GitHub copilot in some capacity, the company said.

The launch of GitHub Copilot Enterprise comes in direct response to customer requests for tools customized to their organization’s code and processes, according to CEO Thomas Dohmke.

The inaccessibility of institutional knowledge acts as a blockade preventing developers from exercising their creativity and building more, he said.

“Developers spend more time deciphering rather than shipping when they can’t pinpoint and solve the issues, bugs, or vulnerabilities that are unique to their organization’s codebase,” Dohmke commented.

“What’s more, developers often write code for only a couple hours a day and, instead of being creative, are bogged down with mundane tasks throughout their day.”

Dohmke said its latest copilot will dramatically improve productivity and knowledge sharing capabilities for developers.

“Now, team members can ask questions about public and private code, get up to speed quickly with new codebases, build greater consistencies across engineering teams, and ensure that everyone has access to the same standards and work that’s previously been done,” he said.

GitHub said the new copilot version can aid in modernizing aging codebases by offering clear code summaries, relevant suggestions, and quick answers to queries about code behavior.

By integrating chat directly into GitHub.com, it enables developers to ask questions and receive answers in natural language about the organization’s codebase, and will guide them to relevant documentation or existing options.

“This can facilitate rapid iteration at scale while improving code with personalized assistance and suggestions tailored to an organization's specific codebase and standards,” Dohmke said.

Copilot Enterprise features pull request summaries which should save time for developers, and because it can analyze pull request diffs reviewers can save time understanding the changes.

GitHub said it is also integrating Bing search directly into Copilot Chat – which is available in beta for GitHub Copilot Enterprise – allowing developers to find the latest software development-related information like updates to CSS or JavaScript frameworks.

The company said that it does not use any of an organization’s private repositories or prompts and suggestions to train the machine learning models that power its products “unless you expressly instruct us to do so, for example with custom models.”

What are developers saying about GitHub Copilot Enterprise so far?

GitHub launched Copilot Enterprise with some comments from early adopters, most of whom believe the tool has markedly improved productivity. 

Tommy MacWilliam, engineering manager for infrastructure at software company Figma, said Copilot Enterprise has improved collaboration across its software development lifecycle by making it easier for its engineers to source and find information via Copilot Chat.

“We're also seeing a significant increase in overall developer productivity. Our engineers are coding faster, collaborating more effectively, and building better outcomes,” he said.

Meanwhile Mark Côté, director of developer infrastructure at Shopify said the company’s developers are already accepting 24,000 lines of code every day with Copilot.

Côté added that with Copilot Enterprise, Copilot Chat provides personalized recommendations for its developers, “making it easier for developers to quickly understand context.”

Copilot Individual, Copilot Business, and Copilot Enterprise: What’s the difference?

There are now three different GitHub Copilot offerings, which differ by feature set and price.

Copilot Individual, for example, is aimed at indie developers and freelancers for $10 per month (it’s free for students, teachers and maintainers of popular open source projects.

This version offers code completion and chat.

Meanwhile, Copilot Business – which costs $19 per user per month – adds more features including command line assistance, security and IP indemnity.

Copilot Enterprise has all of this and – for $39 per user per month adds chat personalized to the enterprise codebase, documentation search and summaries, pull request summaries and code review skills. IT requires GitHub Enterprise Cloud.

How do I get GitHub Copilot Enterprise? 

For developers, once you’re assigned a GitHub Copilot Enterprise seat, you’ll automatically see Copilot in GitHub Enterprise and GitHub Mobile interfaces.

GitHub said these will be indicated by chat and smart actions buttons.

For IDE-based functionalities, you need to install the GitHub Copilot extension specific to their IDE. And if you want to use Copilot in the command line, use GitHub CLI in your terminal and install the Copilot in the CLI extension.

GitHub Copilot could be exacerbating software vulnerabilities due to the generative AI assistant’s tendency to replicate insecure code, researchers have warned. 

Analysis from Snyk found that AI coding assistants such as GitHub Copilot can learn to imitate problematic patterns or utilize vulnerable material within a developer’s system of code. 

If developers are inputting code into GitHub that has security issues or technical problems, then the AI model can succumb to the “broken windows” theory by taking inspiration from its problematic surroundings.

In essence, if GitHub Copilot is fed with prompts containing vulnerable material, then it will learn to regurgitate that material in response to user interactions.  

“Generative AI coding assistants, such as Copilot, don’t actually understand code semantics and, as a result, cannot judge it,” researchers said.

By way of evidence, Snyk highlighted an example in which Copilot utilized the “neighboring tabs” feature to access code for the purposes of context. 

In this instance, the code in question already contained security flaws. Copilot then went on to amplify these security vulnerabilities in its following suggestions, leaving the developer at risk of SQL injection. 

“This means that existing security debt in a project can make insecure developers using Copilot even less secure,” said Snyk.  

The exacerbation of security issues through GitHub should be a concern to developers for several key reasons, researchers said. 

Inexperienced or insecure developers, for example, could begin to develop bad habits as Copilot’s code suggestions reinforce mistakes or poor developer practice.

In a similar way, Copilot could pick up on coding patterns that, though previously acceptable, may have become outdated and vulnerable. 

AI coding assistants also breed a culture which lacks oversight, the study suggested, meaning problematic code may not be checked and so could be proliferated extensively. 

According to Snyk, data suggests that the average commercial project has around 40 vulnerabilities in first-party code, setting the perfect stage for the amplification of flaws if developers are diligent.

Coding assistants like GitHub Copilot should be used with caution

Snyk advised developers to fix issues at the source by ensuring their code is up-to-date and secure. 

“Copilot is less likely to suggest insecure code in projects without security issues, as it has less insecure code context to draw from,” said Snyk. 

The company also suggested some more specific mitigation methods for the various departments which this issue could affect. 

For example, developers should “conduct manual reviews” of code generated by coding assistants that include within them comprehensive security assessments and vulnerability rectifications. This will help reduce oversight blind spots, researchers suggested.  

Security teams, on the other hand, should put static application security testing (SAST) guardrails in place that contain policies for development teams to work to. 

Security teams can also help to provide training and awareness to development teams, as well as “prioritize and triage” the backlog of development team issues. 

The use of AI tools in software development has increased rapidly in recent years, enabling developers to write code faster and supercharge productivity. 

Tools such as GitHub Copilot, for example, use generative AI to generate potential code that developers can then add into their projects, saving them time and effort. 

These are used by millions of developers to generate billions of lines of code, and, according to their makers, can even make developers more productive and happier.

Research from GitHub last year found that developers can complete tasks 55% faster using an AI assistant while 75% of devs said they were more fulfilled.

However, recent research from GitClear examined 153 million changed lines of code written between January 2020 and December 2023 to see if it could spot any code quality differences as a result of the rise of AI coding assistants over that period.

It said it found “disconcerting trends for maintainability”.

In particular, it said that ‘code churn’ – which it defined as the percentage of lines of code that are reverted or updated less than two weeks after being completed – could double in 2024 compared to 2021.

GitClear said that while AI tools help to write code faster, that doesn’t account for the code that shouldn't be written in the first place.

AI coding tools speed up software development - but are we sacrificing quality?

“Writing bad code faster implies considerable pains for the subsequent code readers,” the report said. While AI assistants will offer suggestions for adding code, they won’t offer suggestions for updating, moving, or deleting code because of the limitation of the text-based environments where code authoring occurs, the report added.

Part of the problem, it said, is that code suggestion algorithms are incentivized to propose suggestions most likely to be accepted, while code maintainers are incentivized to minimize the amount of code that needs to be read.

This may explain the difference why junior developers are more likely to accept code suggestions.

“Experienced developers have the most informed understanding of how costly code will be to maintain over time. If they are more averse to using AI suggestions, it raises questions about the extra code that junior developers are now contributing, faster than ever,” the report said.

GitClear’s analysis of million lines of code found that while code churn was “relatively infrequent” when developers were writing all their own code, accounting for around 3-4% of code, this increased to 5.5% in 2023 - and the report suggests it could hit 7% this year.

“The more churn becomes commonplace, the greater the risk of mistakes being deployed to production,” the report noted.

The research also suggested that less code was being moved by developers, suggesting there was less code reuse.

As a code base grows, developers often rearrange existing code into new modules and files that can be reused in new features. That can be a smart move as the code has already been tested and worked on by more developers, so is more likely to include documentation.

However, GitClear said that combined with the growth in code labeled "copy/pasted," there is “little room to doubt” that the current implementation of AI assistants discourages code reuse.

“There is perhaps no greater scourge to long-term code maintainability than copy/pasted code,” the company warned.

Part of this may be down to developers’ own preferences. Because most developers prefer adding new features to interpreting potentially reusable code, copying and pasting code is a habit that often persists “long past its expiration date” the report said.

That can be especially on less experienced teams, or where there may be no code maintainer with the authority to remove the unnecessary code.

“Even when there are senior developers possessing such authority, the willpower cost of understanding code well enough to delete it is hard to overstate,” it said.

GitClear said one question for the future was at what rate development progress becomes inhibited by additional code. “The current uncertainty is ‘when is the accumulated copy/paste tech debt too great to ignore?’” it said.

AI tools are still in their infancy, and they're going to need time

However, the impact of generative AI on coding is far from settled. A smaller survey by software development company Akvelon said these tools can have a positive impact on code quality.

“Developers with a strong foundation of knowledge and experience in their respective domain can extract maximum value from GitHub Copilot,” the report stated. “Their expertise empowers them to dismiss unsuitable suggestions and optimize the utilization of the tool.”

It’s still very early days to work out what the impact on developers will be of these generative AI tools, and it’s likely their usage is going to evolve.

For example, according to a recent survey by JetBrains, although developers do use these tools to write code they are actually slightly more likely to ask these assistants for general information about coding.

In an ideal world, the developers said, they would be most likely to delegate writing documentation to an AI and least likely to delegate code writing. As such, how developers use these tools - and the impact on code - could look very different in a year or two.

Apple is reportedly working on the development of an AI code generation tool as the firm teases a flurry of upcoming generative AI features and tools over the next several months. 

Reports from Bloomberg suggest the company has been working on the tool for the last year as part of a major update to Xcode, the company’s existing programming software used by developers.

The new AI programming tool will reportedly function similar to GitHub’s Copilot tool, which enables users to generate code based on natural language prompts and convert code across multiple programming languages.

GitHub Copilot has been immensely popular among developers since its launch. The AI coding assistant now boasts over one million users, and Microsoft has been keen to roll out new capabilities for the platform.

Recent updates to GitHub Copilot included the launch of new live chat features that can support programmers in real-time, offering advice on code curation.

This new Xcode AI tool will be able to automatically create and finish lines of code, which Apple hopes will enable developers to rapidly accelerate app creation.

Testing of the new functionality has begun internally, Bloomberg reported, and the firm could be preparing to launch the feature to third-party software developers “as early as next year”.

Apple picks up pace in the generative AI race

The move from Apple comes amid a period of intense speculation over its generative AI plans. The tech giant has outlined plans to integrate the technology within Siri and a range of other applications.

But so far, Apple’s foray into the AI race has been subdued compared to other major industry stakeholders such as Microsoft, or Google.

That’s not to say that Apple isn’t making significant strides in this regard, however.

In December, the company released a raft of open source tools as part of a move to provide greater machine learning capabilities on Apple Silicon.

Known as ‘Apple MLX’, the machine learning framework was developed by the firm’s ML research division, and allows users to build AI tools using its in-house silicon.

The MLX framework is available through open source libraries such as PyPI and GitHub, Apple confirmed at the time.

Prior to the launch of Apple MLX, speculation over the extent of Apple’s generative AI ambitions had been growing for some time. Reports from July 2023 suggested that the company was developing its own internal large language model (LLM) known as ‘Apple GPT’.

Details on this model have yet to be confirmed by the tech giant.

CEO Tim Cook has also been reserved on the matter, but in an August interview with CNBC he revealed the firm had plans to ramp up the integration of generative AI capabilities across its product offerings.

Meta has released new versions of its software code-writing generative AI tool Code Llama that can help developers work quicker and more efficiently.

Code Llama is a large language model (LLM) that can use text prompts to generate code. By using generative AI tools like Code Llama, developers should be able to write quicker and better code, while these tools can also lower the barrier of entry to people who are learning to code.

Meta released the original versions of Code Llama back in August last year in three sizes, with 7B, 13B, and 34B parameters. The new offerings include take it up to 70B – 70 billion parameters – with Llama Code 70B being the largest and most high performance LLM in the group so far.

Code Llama 70B is now available in the three versions, all of which are open source and thus free for research and commercial use. The new versions are:

• CodeLlama – 70B, the foundational code model
• CodeLlama – 70B - Python, specialized for Python
• Code Llama – 70B – Instruct, which is fine-tuned for understanding natural language instructions

“Writing and editing code has emerged as one of the most important uses of AI models today,” said Meta CEO Mark Zuckerberg on Facebook, announcing the updated models. Developers can request access to the models from Meta.

Code Llama is a code-specialized version of Meta’s open source Llama 2 foundational general purpose LLM, created by training Llama 2 further on code-specific datasets. That means Code Llama can generate code, and text about code, from both code and natural language prompts. For example, you could ask it to ‘Write a function that outputs the Fibonacci sequence’.

It can also be used for code completion and debugging and supports some of the most popular languages in use today, including Python, C++, Java, PHP, Typescript (Javascript), C#, and Bash.

'Code Llama – Python' is a language-specialized variation of Code Llama. Meta said that because Python is the most benchmarked language for code generation – and because Python and PyTorch play an important role in the AI community – a specialized model would be particularly useful to developers.

'Code Llama - Instruct' is a second variation of Code Llama that has been fed a “natural language instruction” input and the expected output which makes it better at understanding what humans expect out of their code prompts. Because this version has been fine-tuned to generate “helpful and safe” answers, Meta recommends using Code Llama - Instruct variants whenever using Code Llama for code generation.

Meta said it didn’t recommend using Code Llama or 'Code Llama - Python' to perform general natural language tasks since neither of these models are designed to follow natural language instructions. 

“Code Llama is specialized for code-specific tasks and isn’t appropriate as a foundation model for other tasks,” it said.

“Programmers are already using LLMs to assist in a variety of tasks, ranging from writing new software to debugging existing code. The goal is to make developer workflows more efficient, so they can focus on the most human centric aspects of their job, rather than repetitive tasks,” Meta said when it first launched the tools.

Not all AI models used for coding are open source, but Meta said LLMs for coding benefit from an open approach, both in terms of innovation and safety. “Publicly available, code-specific models can facilitate the development of new technologies that improve peoples' lives,” it said.

Meta said that in its own benchmark testing, Code Llama outperformed state-of-the-art publicly available LLMs on code tasks.

Certainly, looking at the updated benchmark data Meta has included, it seems that 'Code Llama Instruct – 70B' and 'Code Llama – Python 70B' do seem to perform very well against the rivals listed. However, the race to be the most high-performing LLMs is a tough one, with each of the big players constantly iterating.

Meta’s LLMs are far from the only option for developers looking to give their code an artificial intelligence boost. Amazon offers its Code Whisperer free for individual developers, while Github Copilot, powered by generative AI models developed by GitHub, OpenAI, and Microsoft, is probably the best known, and claims to make developers up to 55% more efficient at coding.