Eleven companies that rent out AI infrastructure disclosed breaches between October 4 and November 1, 2026 — and only one of them has told you what it's going to cost. That one is Zeabur: a breach in late August, a second on October 14, and on October 17 its founder announced the company is shutting down for good by December 31. The interesting part isn't that the other ten got off lighter. It's that sixteen days after that announcement, OpenAI published proof the other outcome was available — a rebuilt backbone for its own infrastructure, finished before anything forced the question.

What OpenAI built, on November 2, 2026, is boring on purpose: a faster, bigger version of the version-control system every one of those eleven platforms also depends on. This issue is about what separated the platforms now writing incident reports from the lab that didn't have to.

OpenAI rebuilt Git from scratch in ten weeks. Agents wrote most of it.

Starting around the end of 2025, the systems serving OpenAI's monorepo started falling over. Reliability on fetches and pushes fell at times below 90%, as Codex let engineers open far more branches at once than a human-paced team ever had. OpenAI's own account is direct about the question that raised: "Had we reached a limit of Git itself, or of the way we served our monorepo?"

Their answer was neither, and both. They kept the Git protocol and the Git client — the part every engineer and every agent already knows how to use — and replaced the backend underneath it with a new system called Pando. The payoff, in OpenAI's own numbers: Pando cut the median push's latency by nearly 80%, now delivers close to a petabyte of Git data a day, and has served more than 57 terabytes of Git packs in a single hour, with over 99% of those bytes coming straight from local disk cache rather than being recomputed per request.

Paid for plainly: a push is you handing the server your changes; a fetch is you asking for everyone else's. A conventional Git server has to recompute which bytes a given client is missing almost every time — expensive, and hard to cache. Pando instead reuses the same pre-built bundles across many requests, the way a library hands out the same printed book to a hundred readers instead of reprinting it for each one.

Pando went from kickoff to production in ten weeks, serving live traffic since April 2026. OpenAI's description of how: "The core of Pando was designed by a single engineer, implemented by teams of agents, and deployed by a handful of engineers." Agents wrote Lean and TLA+ proofs to formalize a "theory of Pando" to catch race conditions, and ran continuously for hundreds of hours hunting edge cases.

Crucially, OpenAI didn't fork away from Git — it says it's contributing fixes back upstream, including improvements to packfile-uri, the under-used Git protocol feature Pando leans on to hand clients download links instead of cramming everything into one response. Whether that upstreaming actually reaches the Git every other company runs, or stays mostly a private advantage, is this issue's open question — see One to watch.

Eleven AI developer platforms disclosed breaches inside one month. Zeabur didn't survive the second one.

Wiz's security team has been tracking what it calls "Black October" for AI developer platforms: at least nine incidents disclosed between October 6 and October 30, 2026, plus two more it added by edit — Brev (NVIDIA), spanning October 4–20, and Trigger.dev, disclosed November 1. Eleven total, none sharing a single root cause, all targeting the same thing.

As Wiz puts it: "Any other month, and this would be the top security story." With eleven incidents inside four weeks, almost nobody connected them into one pattern.

Fireworks, Zeabur and Lightning all trace their root cause to stolen credentials. Fireworks, OpenCode and Warp each separately reported signs of an agent swarm attack — many AI agents working a target in parallel rather than one human at a keyboard. OpenCode and CommandCode both attributed their incidents to attempted distillation: querying a protected model relentlessly to train a cheap copy of it, legitimate as a research technique, an attack the moment the queries aren't authorized. Railway's own account goes further, saying initial evidence suggests the attacker had access to "abliterated models" — open models with their safety refusals stripped out — "and substantial compute resources which enabled them to perform highly sophisticated exploits."

What was actually stolen tells the real story: not source code, but access. OpenCode's co-founder Dax Raad said the attack ran for 48 hours before the company could use OpenAI's Daybreak security model, newly approved that Saturday, to fight back; some of its 1.4% of affected console users saw up to $1,700 in unauthorized charges overnight. Wiz's own forensics on two compromised enterprise keys found attackers testing stolen credentials across resale markets, then, once validated, routing roughly 800,000 Bedrock calls over 30 hours, 90% of them successful, three-quarters of the traffic on Opus models. Roughly $371,000 in cryptocurrency was separately reported stolen using keys lifted from Railway.

Zeabur's case ended differently from the other ten. On October 17, 2026, three days after the breach, founder Yuanlin Lin announced the company is shutting down:

The wind-down, in his own words, runs on a fixed schedule:

Scheduled / Standing Now → purchases of new dedicated servers and domains stopped. December 1, 2026 → dedicated server renewals disabled; shared-cluster services paused. December 31, 2026 → every dedicated server and shared cluster stops operating.

Lin's post names a second cause alongside the breach: three and a half years of rapid pivots had left the architecture "increasingly complex and difficult to maintain," and growth had "started to run into limits." The breach didn't build that problem. It forced the decision about it.

When analytics on Postgres slows down, most teams add a second database. Then come the pipelines, the sync jobs, and a copy of your data that's always a little behind.

TimescaleDB takes a different approach: extend Postgres instead of splitting away from it. Hypertables partition your data automatically as volume grows. Hypercore compression cuts storage up to 95%. Continuous aggregates keep dashboards live without re-querying everything.

CERN runs Postgres this way for sensor data from the Large Hadron Collider.

No split architecture, no pipeline lag, no new query language to learn. Same SQL, same drivers, same tools.

Start on Tiger Cloud and get $1000 in credits.

Get $1000 Credit

Scaling for agents and securing what agents touch are the same engineering problem. One company solved it ahead of time. Eleven didn't, and an attacker solved the ordering for them.

Put Pando and Black October side by side and the asymmetry is the whole story. OpenAI saw its monorepo reliability sliding toward failure and spent a year — then ten focused weeks — rebuilding before the breakage became an incident. Eleven AI developer platforms had the same underlying pressure: agent-driven usage scaling faster than the infrastructure holding credentials around it. None of them got ten quiet weeks. An attacker made the scheduling decision for them, hunting stored API keys because a stolen AI key is now liquid — resold through markets like the ones Wiz found, run through 30-hour bursts of inference before anyone notices the bill.

Say it in one line a colleague will repeat: the companies writing incident reports this month didn't lose a security argument — they lost a scheduling argument, and nobody told them they were in one.

The 20-minute job this week, in order. One: list every AI provider API key your product holds, and where each one physically lives — a deploy platform's environment variables, a CI secret store, a proxy's log sink. Two: if any of those eleven platform names is in your stack, rotate the relevant keys now, whether or not you received a notice — Fireworks' own bulletin shows affected customers were identified in batches over several days, not all at once. Three: ask whether your own credential rotation schedule currently depends on a human remembering, or on a calendar job that fires regardless.

⚠️ The counter-view, and it is real. Lumping eleven incidents under one "AI platforms are collapsing under agent scale" banner overstates how connected they are. Wiz's own post is careful not to claim a single cause — Fireworks and Zeabur point to credential theft, Railway to a build-infrastructure privilege escalation, Warp to a third-party vendor dependency, OpenCode to a "legacy system." Stolen AI credentials have simply become easy to resell — the LLMjacking and distillation markets Wiz documents — which gives attackers a reason to target this category broadly regardless of whether any individual platform's engineering was actually strained by agent-scale load. And Zeabur's own founder names a second, older cause for the shutdown: an architecture that was "increasingly complex and difficult to maintain" well before October. The breach may have been the occasion for the decision, not its sole cause.

Does Pando's fix for Git at agent-scale stay OpenAI's alone, or does it reach the Git that every one of those eleven breached platforms also runs?

OpenAI says its public distribution of Git already ships to developer machines and inside the ChatGPT desktop app, and that fixes surfaced while building Pando — including improvements to the packfile-uri protocol extension — are being contributed back upstream to the Git project itself. That is a different commitment from open-sourcing Pando's backend, which OpenAI has not done and has given no indication it will.

If the upstreaming is real and substantial, every self-hosted Git server on earth — including the deploy platforms that just spent October writing incident reports — gets a sliver of the same scaling benefit for free, with no OpenAI dependency required. If it stays symbolic, "built with Codex" becomes a sentence about OpenAI's internal advantage, not about the ecosystem. Worth checking back on: has anything from Pando actually landed in git.git by the time the next issue of this newsletter goes out?

What's the one line item in your stack you'd double-check after reading this list? Reply and tell me — I read every one, and the next issue is better because of them.

If this was worth your time, forward it to whoever on your team owns the deploy platform decision.