{"schema_version":"0.10.0","id":"LR-2026-0604","record_version":1,"title":"GitHub outage caused by AI-driven traffic surge and configuration error","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: 36Kr · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: 36Kr · subject to change"}]},"sources_hash":"6ba074287971ad42fb15fa9bd9f1bd64ff19fb684eb044c73454e711796cf89c"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-04","incident_class":"operational_error","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"GitHub, a code hosting platform used heavily by developers and by AI agents, suffered a wide outage on February 9, 2026 (Beijing time). GitHub's incident report gave the root cause as an overload of the core database cluster responsible for authentication and user management. Press reports tie it to an engineering change made two days earlier that reduced a user settings cache refresh from 12 hours to 2 hours, compressing cache rewrites into a storm that spread through shared components to platform-wide connection exhaustion. GitHub's CTO named rapid load growth, tight coupling between services and a lack of protection against abnormal client traffic as structural causes. GitHub later announced plans to redesign its architecture, including better change management.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"an overload of the core database cluster responsible for authentication and user management","failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test: many third parties, with a stated count of tens of millions of developers opening GitHub to the same failed page.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://eu.36kr.com/en/p/3838634999417353","publisher":"eu.36kr.com","date":"2026-06-04","type":"press","title":"GitHub has been completely disrupted by AI. - eu.36kr.com","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.kucoin.com/news/flash/github-outage-caused-by-ai-driven-traffic-surge-and-configuration-error","publisher":"KuCoin","date":"2026-06-04","type":"press","title":"GitHub outage caused by AI-driven traffic surge and configuration error - KuCoin","archived_url":null}],"per_field_confidence":{"event.root_cause_detail":"C","event.responsible_party":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.root_cause_detail":[{"source_index":0,"quote":"In technical terms, the root cause was \"an overload of the core database cluster responsible for authentication and user management\"."}],"event.responsible_party":[{"source_index":0,"quote":"GitHub was brought down by a configuration change it made itself."}],"event.incident_class":[{"source_index":0,"quote":"GitHub was brought down by a configuration change it made itself."}],"impact.severity":[{"source_index":0,"quote":"On February 9th this year, late at night Beijing time, tens of millions of developers around the world opened GitHub and saw the same page."}],"impact.severity_because":[{"source_index":0,"quote":"On February 9th this year, late at night Beijing time, tens of millions of developers around the world opened GitHub and saw the same page."}],"event.summary":[{"source_index":0,"quote":"On February 9th this year, late at night Beijing time, tens of millions of developers around the world opened GitHub and saw the same page."},{"source_index":0,"quote":"In technical terms, the root cause was \"an overload of the core database cluster responsible for authentication and user management\"."},{"source_index":0,"quote":"Two days before, in order to push a new model to users as soon as possible, the engineering team changed the refresh time of a \"user settings cache\" from 12 hours to 2 hours."},{"source_index":0,"quote":"As a result, the cache rewrites that were originally spread over 12 hours were compressed into 2 hours, forming a dense \"cache rewrite storm\"."},{"source_index":0,"quote":"He said that there are three common structural reasons behind these incidents: \"rapid load growth, tight coupling between services leading to the spread of local malfunctions, and the system's lack of the ability to protect against abnormal client traffic.\""},{"source_index":0,"quote":"By February 2026, after that serious outage, GitHub announced that it needed to redesign the architecture to be 30 times the current scale."}]},"notes_on_gaps":"Only one press source (36Kr, republished from GeekPark) was supplied, plus a near-duplicate KuCoin rewrite; GitHub's own incident report and CTO blog are cited but not provided, so no primary-source figures are available. Not stated: exact outage duration, recovery time, records or money lost, country, detection method, and whether any AI agent directly triggered the Feb 9 outage; the sources describe AI agent traffic growth as background load, so agent_involved, failure_class and trigger are left out. The title's AI-driven framing is not directly supported for Feb 9 beyond that background. Judgement: root_cause set to infrastructure (the stated overload) with the configuration change treated as the incident_class operational_error and responsible_party provider; severity set to major because tens of millions of developers were stated as affected. The 'fix' remediation is the disclosed direction of planned changes, not a confirmed completed change. The 'two days before' date is relative and was not converted to a calendar date. The Feb 2, Mar 5 and Mar 18 incidents are separate from this one and are listed only as context. Year 2026 comes from the article's framing of 'this year'. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: 36Kr · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Separate later incident: Webhook delay rose to 32 times the normal level.","quote":"March 18th: The Webhook delay soared to 32 times the normal level.","source_index":0,"when":"2026-03-18"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://eu.36kr.com/en/p/3838634999417353","https://www.kucoin.com/news/flash/github-outage-caused-by-ai-driven-traffic-surge-and-configuration-error"]}}