GitHub commits hit 7.38 billion in September as Rust rewrite, AI agents and supply-chain attacks reshape developer workflows

Commit volume from humans and agents forces GitHub to rebuild core infrastructure

A surge in commits is straining the platform itself. In September 2026 alone, developers and agents made 7.38 billion commits on GitHub, and the company is projected to log roughly 14 billion across the full year — about fourteen times the 1 billion recorded in 2025, per COO Kyle Daigle. That scale is the backdrop for GitHub's broader plan to retool its Git infrastructure, with reported targets of 35x higher write throughput to absorb the load.

Copilot runtime moves from Node.js to Rust with AI-assisted development

The answer to that load includes moving performance-critical code off Node.js. GitHub migrated more than 800000 lines of Copilot runtime code from TypeScript and Node.js to Rust in about 14.5 weeks, using AI-assisted development to drive the port. The migration is a concrete signal that the company now treats Rust as the default for hot paths inside its flagship AI coding product.

Credential-stealing GitHub Actions workflows hit tens of thousands of repositories

Scale also widens the attack surface. Security researchers at Socket identified more than 500 GitHub accounts that committed a malicious GitHub Actions workflow to tens of thousands of repositories since October 7, 2026. The campaign is built to steal credentials from CI pipelines, and its spread through Actions — a feature used precisely to automate work at commit-time — turns the same scale advantage into a delivery mechanism.

AI coding agents generate more code, but human review remains the bottleneck

The productivity question underneath all of this remains unresolved. A study reported on October 9, 2026 found that AI coding agents generate more code, but not more software, with efficiency gains absorbed by a human review bottleneck. That framing matters because the 7.38 billion September commits include work done by agents, raising the question of how much of that volume actually clears review and ships.

What practitioners should check in the next sprint

Three concrete items deserve a follow-up before the next commit. First, watch for GitHub's Git infrastructure rebuild milestones; the reported 35x write-throughput target is the metric that will decide whether agent workloads stay healthy at 14-billion-commits-per-year scale. Second, audit every GitHub Actions workflow added or modified since October 7, 2026 — including indirect forks and template copies — for the credential-stealing pattern Socket described across tens of thousands of repositories.

Third, instrument human review capacity the same way you instrument CI: if agent output is up roughly tenfold, track review queue depth and cycle time, because the recent study's "human bottleneck" finding is the constraint that decides whether faster commits translate into faster shipping.