Article — "AI Agents Outgrow the Code Supply Chain They Depend On": On November 3, GitHub's status page logged two incidents in a single day. One of them affected Git operations — the plumbing that every clone, fetch, push, and merge depends on. The next day, merge requests started failing again, with some dropped or delayed.
The timing was almost too neat. That same week, Axios reported that OpenAI was in talks to acquire Pierre, a code-hosting startup. GitHub was visibly buckling under AI-generated code volume at the exact moment one of the labs driving that volume moved to buy the layer underneath it.
Last week we covered agent stacks and harnesses — the scaffolding that decides how an agent plans and acts. This week the story moved one layer down, to the source control those agents write into. That layer is failing, and the labs are quietly taking it over.
The companies selling the agents that generate the load are capturing the layer that absorbs it.
The load is not hypothetical. OpenAI's technical staff reported that commits landing on its master branch grew 1,378% between Q1 2024 and Q3 2026, with a Q4 estimate of 2,442%. Its prior Git infrastructure suffered slow fetches and pushes and failed merges, with reliability at times falling below 90%.
OpenAI's fix is Pando, a Rust backend that went from kickoff to production in 10 weeks and began serving real development traffic in April. In production it cut median push latency by nearly 5x — down almost 80% — and now moves close to a petabyte of Git data per day. It replaced a system that had been the company's own monorepo host, though OpenAI hasn't said which host that was.
The design choice matters more than the benchmark. Pando coordinates writes per branch rather than per repository, so pushes to unrelated branches proceed in parallel. It also reuses cached packfiles instead of building a custom pack for every reader, letting the server hand the same bytes to many clients. OpenAI reports cache hit rates above 99% and over 57 terabytes served in a single hour, with more than 99% of those bytes from local disk cache.
The tradeoff is real: a client reading several branches cannot assume those reads describe one point in time across the repository. OpenAI accepted that, because the work that broke the old system only ever needed one branch's ordered history.
Anthropic hit the same wall from the other side. Its daily merged changes went from roughly 2,500 in May to over 30,000 in September — a twelvefold jump in four months. Continuous integration jobs alone fetch code about 25 million times a day.
At peak, Anthropic maintained hundreds of Git mirrors to spread the load, but the faster the main repository moved, the harder those copies were to keep current. Engineers noticed that most fetches came from always-on agents and automation, and that a task needing to know which lines changed in one file shouldn't require a local copy of the whole repo. So they built Scion — a version control system with client-side file-on-demand retrieval and server-side history, commits, and merges — and migrated the company's main codebase onto it, with seven engineers and Claude taking five months. Public Claude Code repositories stayed on GitHub.
Cursor moved fastest of all. SpaceX closed its acquisition of Cursor on August 14. Three days later, on August 17, Cursor opened early testing for Origin, its own code-hosting service — the same day GitHub suffered an outage lasting 7 hours and 47 minutes. A Cursor employee joked that they'd meant to ship earlier, but GitHub went down again.
Origin lets developers create repositories, push code, take review comments, and merge branches without opening GitHub at all. Existing GitHub projects can sync a copy into Cursor, where review comments flow back and GitHub remains the source of truth. But the operative question, as one observer put it: if you can write, review, and merge inside Cursor, why open GitHub?
GitHub is not standing still. On October 28 it disclosed that it has added 4 million CPU cores and 160 petabytes of high-speed storage this year, and is continuing to migrate services to Azure. It is also reworking how writes queue — previously, agents on different branches could still block each other on the same repository's write path — and separating read and write resources so fetch-heavy CI jobs don't compete with pushes. Those changes are rolling out in stages.
So the structural picture is now clear. OpenAI is building Pando and reportedly buying Pierre, whose Trees and Diffs views already render file changes inside Codex, and whose Code Storage backend serves customers like Lovable — which, as of August, was creating over 8 million repositories a week, peaking at 250 per second. Anthropic built Scion and Antique, its review tooling, in-house. Cursor built Origin. The companies selling the agents that generate the load are capturing the layer that absorbs it.
This is the same vertical-integration logic that drove the compute buildout. Labs that couldn't buy enough GPUs at the right price built their own clusters, signed their own power deals, and financed their own data centers. Nobody argued that was a distraction from the models; it was the precondition for training them. Source control is now in that category. You cannot ship agents that write code at Codex or Claude Code volume if your repository backend fails merges, and you cannot rent that guarantee from a vendor whose incentives and roadmap you don't control.
The moat argument is easy to misread. It isn't that Pando or Scion is technically superior to GitHub — OpenAI hasn't open-sourced Pando, published no API, and released no deployment guide, and the performance numbers are self-reported. It's that the hosting layer now determines throughput, review, and retention of AI-written code. Throughput, because merge reliability gates how much agent output actually lands. Review, because the diff and tree views inside the coding tool become where humans look at what the agent did — Pierre's tools are already embedded in Codex for exactly this reason. Retention, because a developer whose entire write-review-merge loop lives in one product has little reason to leave it.
That last point is the quiet one. When review comments sync bidirectionally and GitHub remains the source of truth, the switching cost looks low. When the review queue, the merge button, and the agent that wrote the code all live in the same interface, it isn't.
Meanwhile the review problem compounds behind the hosting problem. Anthropic has engineers verify agent output through recordings, screenshots, and test results, with a named owner per change. During a single test run, hundreds or thousands of additional changes can land in the repository. Repository-wide locks for coordinating merge queues stop working at that scale, and Anthropic has said concurrent modifications can still conflict — Claude usually resolves them faster than a human, but the company hasn't published numbers.
That is the part the buildout doesn't solve. Faster pushes and cheaper fetches increase the rate at which unreviewed code arrives. Whoever owns the hosting layer also owns the natural place to put the review gate — and owns the default answer to what "merged" even means.
Which is why the interesting question is no longer which lab has the best coding model. It's who owns the Git backend underneath it. The compute buildout taught the industry that the layer everyone assumed was a commodity — servers, power, cooling — could become the binding constraint and the durable advantage. Source control is now that layer, and the labs are already building it.
The user-facing wish remains modest: when the code is written and checked, don't fail the merge. The industry's answer, so far, is to stop asking GitHub to be the one that doesn't.