GitHub’s infrastructure wasn’t built for a world where most pull requests come from agents. That’s the core tension Kyle Daigle, GitHub’s COO, laid out in a detailed conversation on Latent Space — and the company is rebuilding around it.
The key problems Daigle flagged:
- AI-generated PRs are flooding open source. Maintainers are split on whether agent-submitted contributions help or hurt. Some embrace them; others see noise. GitHub needs new signals to distinguish useful agent PRs from spam.
- npm supply chain security gets harder. When agents can publish packages autonomously, the attack surface for dependency poisoning grows. GitHub is treating this as a first-order infrastructure problem.
- GitHub Actions as compute layer. Agents need to run somewhere. Actions is becoming the default execution environment for Copilot’s agentic workflows — plan, implement, open PR — all asynchronous.
- Trust and identity for agents. Who authored a commit when an agent wrote the code? GitHub is working through attribution, permissions, and audit trails for non-human contributors.
Daigle described GitHub’s internal AI workflows — including micro-skills, WorkIQ, MCP integrations, and Slack-connected agents — as the testing ground for what ships externally. The company is already positioning Copilot agents alongside third-party options like Claude and Codex, letting teams pick the right agent per task.
The pull request itself is under pressure. When an agent handles implementation end-to-end — from issue to plan to code to PR — the review step becomes the primary human touchpoint. Daigle’s framing: the PR isn’t going away, but its function shifts from “review my work” to “approve this agent’s output.” That’s a different cognitive task, and GitHub’s tooling needs to match.
NOTE
Daigle acknowledged that maintainer opinions on agent PRs vary widely across communities. There’s no single policy that works globally — GitHub is exploring per-repo and per-org controls.
The podcast is worth the full listen for anyone building on or around GitHub’s platform. Daigle is unusually specific about where the strain points are — not just where the product is headed, but what’s breaking right now. Full episode on Latent Space.