When Microsoft announced it was acquiring GitHub in a $7.5 billion deal in 2018, developers were nervous. Some feared Microsoft's control over the world's largest code repository, while others adopted a wait-and-see approach. Nearly eight years later, GitHub is now fighting for its survival, plagued by outages, security issues, and intense pressure from competitors.

In recent weeks alone, GitHub experienced multiple major outages, a critical remote code execution vulnerability disclosure, and a breach of its internal code repositories after an employee installed a malicious VS Code extension. Current and former employees describe a company struggling with a lack of leadership and mounting external threats.

The collapse of leadership

GitHub's troubles trace back to last summer when former CEO Thomas Dohmke resigned, triggering a significant shakeup. Microsoft did not replace Dohmke, instead forcing GitHub's leadership to report directly to Microsoft's CoreAI team, led by former Meta engineering chief Jay Parikh. Sources say Parikh is not well-liked among Microsoft employees, and his decision not to appoint a new CEO has left GitHub without a clear direction.

Since Dohmke's departure, a talent exodus has accelerated. Many GitHub employees have followed Dohmke to his new startup, Entire, a developer platform that directly competes with GitHub. Out of 30 employees listed at Entire, at least 11 previously worked at GitHub. This exodus compounds the loss of veteran Microsoft executive Julia Liuson, who left after 34 years, and Jared Palmer, who departed for Xbox after only six months as senior vice president. Elizabeth Pemmerl, GitHub's former chief revenue officer, also resigned, replaced by Dan Stein from Microsoft's Customer and Partner Solutions team.

One employee lamented, "There's basically no more GitHub at all anymore. It's all Microsoft, and the company is collapsing."

Outages and security failures

GitHub's outages have been particularly damaging. CTO Vladimir Fedorov, who joined a year ago from Facebook, personally apologized for the recent incidents, admitting the platform is struggling with a huge growth spike in pull requests, commits, and new repositories. "Our priorities are clear: availability first, then capacity, then new features," Fedorov said. He outlined efforts to reduce unnecessary work, improve caching, and isolate critical services.

The outages come amid GitHub's ongoing migration to Azure servers, a complex project Fedorov initiated to address data center capacity issues. However, the migration has caused additional instability, angering developers like Mitchell Hashimoto, creator of Ghostty terminal, who announced he is leaving GitHub after 18 years. "GitHub is failing me, every single day," he wrote.

Security incidents have compounded the problem. In March, researchers from Wiz used AI models to uncover a critical vulnerability in GitHub's internal git infrastructure that could have exposed millions of repositories. GitHub rushed a fix within six hours. Earlier this week, 3,800 internal repositories were breached after an employee installed a malicious VS Code extension. Microsoft employees note that VS Code often prompts for new extensions, and similar malicious extensions have previously bypassed Marketplace checks.

Intense competition

Jay Parikh is reportedly concerned about competition from Cursor and Claude Code, which have overtaken GitHub Copilot in the AI coding arena. Despite an early lead, Copilot has fallen behind over the past year. Microsoft considered acquiring Cursor to close the gap, but instead began canceling internal Claude Code licenses to force developers back to Copilot. The pressure is intense, with Parikh privately warning colleagues that GitHub "faces a critical threat."

GitHub also faces backlash over its move to usage-based billing for Copilot, which will cut off users who exceed monthly AI credit allotments unless they pay for more. Developers who previously enjoyed unlimited experimentation now face new costs.

Historical context

GitHub was founded in 2008 and quickly became the default platform for open-source collaboration. Microsoft's acquisition in 2018 was seen as a strategic move to win back developers after years of animosity over proprietary software and patent lawsuits. Under former CEO Nat Friedman, GitHub thrived, integrating with Microsoft services while maintaining cultural independence. After Friedman stepped down in 2021, Thomas Dohmke took over and oversaw the launch of Copilot, which initially generated excitement.

However, the integration into Microsoft's CoreAI group has eroded GitHub's autonomy. The Developer Division, once led by Julia Liuson, was dissolved, and GitHub's product work is now split across multiple Microsoft teams. Revenue reporting now goes through MCAPS, further distancing GitHub from its roots. Some insiders fear that Microsoft's bureaucracy is stifling the agility that made GitHub successful.

The Azure migration itself presents a paradox: while Microsoft's cloud infrastructure offers scalability, the transition is fraught with technical challenges. GitHub manages complex MySQL clusters, and any misstep during migration can trigger cascading outages. Fedorov acknowledged that the migration is a multi-year effort and that temporary disruptions are inevitable.

Security lapses have also drawn scrutiny. The VS Code extension incident highlights the difficulty of securing a large workforce accustomed to open-source tools. Microsoft has since implemented stricter extension policies, but the damage to GitHub's reputation is done.

Competitors like Entire, GitLab, and SourceHut are eager to capitalize on GitHub's struggles. Entire, founded by Dohmke, promises a developer-centric platform without Microsoft's corporate constraints. Cursor and Claude Code are winning over developers who demand more advanced AI coding assistance. Even within Microsoft, some teams have begun using alternative tools, further undermining GitHub's position.

Xbox's recent hiring spree of former CoreAI executives suggests broader dissatisfaction with Parikh's leadership. Jared Palmer's move to Xbox as VP of engineering and technical advisor to CEO Asha Sharma is a notable departure. Xbox itself is undergoing a rebranding to XBOX in all caps, and its new strategy includes hiring game industry analyst Matthew Ball as chief strategy officer.

GitHub's survival hinges on whether Parikh and the CoreAI team can reverse the tide. They must stabilize the platform, restore security confidence, and revitalize Copilot to compete with rivals. The stakes are high: if GitHub fails, Microsoft risks losing the developer community that has been central to its resurgence under CEO Satya Nadella.

Developers have long memories. The loss of trust is difficult to rebuild, especially when competitors offer seamless experiences. GitHub's outages have become a running joke on social media, undermining the reliability that developers demand. The security breaches raise questions about data protection, particularly for enterprises hosting proprietary code on the platform.

Microsoft's broader strategy for AI and developer tools is also in flux. The company recently appointed its first chief design officer, Jon Friedman, to oversee the integration of AI across products. Friedman acknowledged that early Copilot integration was insufficient: "Simply attaching it to existing experiences isn't enough to create value." This recognition may lead to improvements, but time is running short.

Meanwhile, Microsoft is phasing out SMS authentication for personal accounts in favor of passkeys, and teams are exploring new features like an adjustable taskbar in Windows 11. These moves signal a company striving to modernize, but GitHub's challenges show that even the largest tech giant cannot take its developer relationships for granted.

As the industry watches, GitHub's fate will be determined by whether Microsoft can recapture the independent spirit that once made GitHub a beloved developer tool. The next few months are critical. If the outages continue, if the talent drain persists, and if competitors gain further ground, GitHub may become a cautionary tale of a great acquisition gone wrong.

Source: The Verge News