Market & Regulation

GitHub blocks pull_request_target by default

GitHub ChangelogNovember 2, 2026high confidence

Why it matters

→Reduces supply chain attack surface for public open source projects by default.
→Forces maintainers to explicitly audit and allow specific workflow triggers.
→Applies to all public repos on GitHub Free, Team, and Enterprise Cloud.

GitHub blocks pull_request_target by default — ©GitHub Changelog

GitHub announced that starting December 2, 2026, all public repositories will block pull_request_target events by default unless explicitly allowed via Actions event policies. This change targets a common supply chain risk where untrusted fork code can access base repository secrets. Private and internal repositories remain unaffected. GitHub will conduct two brownout windows in November to help users identify impacted workflows before permanent enforcement.

Read original

The story around this

Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.

How we got here

1
GitHub Actions Adds Workflow Approval for Security
GitHub Changelog · July 28, 2026 · Related
2
GitHub Enhances Security with New Pull Request Rule
GitHub Changelog · September 9, 2026 · Same story

More from GitHub Changelog

Coding Toolscoding

GitHub adds repo protection status to security assessments

GitHub’s security risk assessments now explicitly flag whether findings reside in protected or unprotected repositories. This small but critical detail shifts the focus from mere vulnerability count to actual exposure surface, allowing admins to prioritize remediation based on branch protection rules rather than just severity scores. It effectively bridges the gap between static code analysis and real-world deployment risk by highlighting where weak guards leave code vulnerable. For security managers, this means fewer false alarms on locked-down branches and a clearer path to hardening the most exposed parts of their codebase.

GitHub ChangelogNov 2, 2026

More in Market & Regulation

Market & Regulationbusiness

Apple eyes third-party AI app revenue

Apple is quietly pivoting to monetize the AI wave through its App Store, signaling that third-party AI agents could become a new revenue stream. This shift addresses regulatory headwinds and an 18% drop in U.S. commission revenue by potentially taking a cut of AI agent transactions. While details remain vague, the move suggests Apple sees AI as a key driver for upgrades and subscription growth. It marks a strategic adaptation to maintain services dominance amid global legal pressures.

TechCrunch AINov 3, 2026

Trajectory raises $45M for automated AI continual learning

Investment · $45M

Market & Regulationbusiness

Trajectory raises $45M for automated AI continual learning

Trajectory’s $45 million Series A signals a pivot toward making post-training accessible to non-technical experts. By automating continual learning, the startup lets domain specialists like lawyers and doctors refine open-source models through feedback loops without hiring expensive research teams. This approach bridges the gap between foundational models and specialized industry needs, potentially lowering the barrier for enterprise AI adoption. With backing from Sequoia and Nvidia, Trajectory is positioning itself as a critical infrastructure layer for vertical-specific AI applications.

TechCrunch AINov 2, 2026

Anthropic warns RSI threshold is imminent

Investment

Market & Regulationother

Anthropic warns RSI threshold is imminent

Anthropic’s revised S-1 filing drops a sobering admission: the company believes it is imminently close to Recursive Self-Improvement (RSI). This isn't just theoretical speculation; they explicitly state that AI-driven R&D may have already caused capability leaps they didn't initially recognize. While no current model has crossed the threshold, the warning signals a critical inflection point where automated progress might outpace human safety validation. It forces the industry to confront whether human-in-the-loop oversight can survive the acceleration it helped create.

TechCrunch AINov 2, 2026