Everyone remembers the chocolate factory episode of I Love Lucy: the conveyor belt starts at a civilized pace, picks up speed, and two perfectly competent employees end up stuffing evidence into their hats. GitHub just published its own version, except the chocolates are pull requests and the hats are a security problem.
In an October 7 post on its blog, GitHub says one in three pull requests on its platform now involves an AI agent, up from fewer than one in ten a year ago. A pull request, for the non-coders, is a developer saying “here’s my change, please look it over before it goes live,” the code equivalent of asking a coworker to proofread your email before you hit send. Agents are now sending those requests at a rate no coworker’s inbox was built for. If that pace holds, GitHub says, most of the code pushed to the platform could be written by an agent within two years. “Much of it may never be fully read by a human,” the post adds. That’s a sentence you’d normally find on a warning label, not a product blog.
The post is really about leaked secrets, the passwords and access keys developers accidentally paste into public code. By GitHub’s own count, a new secret appears in public code about once every two seconds, a rate that has doubled each year for three years. The company’s argument is that AI isn’t making developers sloppy, it’s making them outnumbered. Public pushes grew roughly 2.8 times in two years, the share carrying a secret showed no detectable trend, and the share of blocked pushes that developers chose to override fell from 6.63 percent to 3.93 percent. In belt terms, Lucy isn’t getting careless. The belt is getting faster.
Cleanup is where it hurts. GitHub says push protection now blocks a secret at least once a second, but when one slips through, a human usually has to revoke it by hand, which takes about 40 days on average, and about one in five takes more than 90. That’s a long time to leave your house key under a mat labeled “key.” GitHub’s answer is a new small AI model that reads the surrounding code to catch password-like values in under two milliseconds, which it says could more than double the number of secrets it stops. It’s in private preview and, per GitHub, reaches paying security customers later this month, using AI credits. So the fix for too much AI-written code is more AI, billed by the credit, which is either the circle of life or a very efficient way to sell conveyor belts and hats.
The jobs picture is less grim than the belt suggests, with an asterisk. CNBC reported on October 11 that, per Indeed Hiring Lab, U.S. software developer job postings are up nearly 15 percent since February 2025 even as overall postings fell 7 percent. They are still about 27.5 percent below their pre-pandemic level, and the gains skew senior: senior roles made up 71 percent of the increase between May 2025 and May 2026. McKinsey’s Eric Kutcher told CNBC that companies are producing more code than ever and that developers who work with AI remain in high demand. The asterisk is the new hires: CNBC, citing Stanford’s 2026 AI Index, says employment for early-career software developers has fallen 20 percent since generative AI took off. Someone still has to stand at the end of the belt, and it turns out that’s an actual job, as long as you already have ten years of experience.
In the original episode, the supervisor kept asking for more speed and nobody asked who was checking the chocolates. Some things really don’t change, except that the supervisor now has a Copilot.
Sources: GitHub Blog — Secret Protection Must Scale With Software (https://github.blog/ai-and-ml/github-copilot/secret-protection-must-scale-with-software/); CNBC — AI Is Automating Coding. So Why Are Software Developer Job Postings on the Rise? (https://www.cnbc.com/2026/10/11/ai-software-developer-jobs.html)