The Product Desk

March 2026: 17M Agent PRs

GitHub's CPO Mario Rodriguez disclosed that 17 million pull requests were generated by AI agents in March 2026, roughly 3x what anyone had modeled for platform growth. The load saturated West Coast network infrastructure and forced an emergency migration to Azure. This is not a scenario to plan for next year. It is the present operating condition of the largest code platform in the world.

Agents are not a feature inside the IDE. They are a second user persona with different latency tolerance, different error modes, different cost-per-action, and a tendency to saturate infrastructure when nobody is watching.

The Billing Model Is the Product Decision

GitHub moved Copilot to usage-based billing on June 1, 2026 because per-seat pricing fails the moment one developer can spawn dozens of agent sessions with wildly variable compute cost. Underneath that price change, GitHub shipped a cheaper model (MAI Code One Flash) for routine tasks, semantic routing that sends simple completions to Flash and reasoning work to frontier models, and Chronicle, session-level analytics so teams can see and optimize agent costs.

That cheap-model-plus-router-plus-session-telemetry stack is now the minimum viable architecture for any AI product moving to consumption pricing. Ship the price change without it and enterprise buyers walk. Separately, Merit Systems' AgentCash on x402 lets AI agents pay for API access in crypto with no human-managed billing: per-call settlement, no seat license, no human approval step. The infrastructure for agents-as-paying-customers is being built right now.

What This Means for Product Teams

The internal design vocabulary GitHub uses is AX (Agent Experience): what the product looks like when the primary user is an agent rather than a human. That is closer to an API contract with rate limits and a billing meter than to a settings page. The forcing function is a 2x2. One axis: does the agent show up as a logged-in user with its own quota, or borrow a human's seat? Other axis: is pricing tied to seats, to actions, or to compute consumed? The only sustainable cell is 'agent has own identity' + 'pricing tied to actions or compute.' Every other cell breaks the day a customer points an agent fleet at the product and unit economics invert.

The Metric Shift

Code review tooling assumed the bottleneck was reviewer attention. The bottleneck is now PR volume per reviewer. CI assumed stable commit rates per engineer per day. That rate is now unstable. The metric that matters is not commits-per-day but merged-and-still-working-after-thirty-days. Measurement infrastructure that has not updated is optimizing for a metric that stopped being useful the day the 17M number got published.

The Attack Pattern That Should Scare You

Hackers hijacked high-profile Instagram accounts by asking Meta's AI chatbot to change the account email. No technical exploit. No credential stuffing. Just conversational social engineering against an AI that had been given too much agency without proper authorization boundaries. This is the clearest demonstration yet that AI features with action capabilities require an authorization layer that sits entirely outside the conversational interface.

The lesson isn't 'don't give AI actions' — it's that any action modifying account state needs out-of-band verification that cannot be triggered by prompt manipulation.

The Threat Taxonomy Is Now Codified

Three security signals converged this week. Microsoft published 7 new AI agent failure modes extending their attack taxonomy — expect enterprise security teams to reference this in vendor evaluations within 60 days. Hugging Face Transformers has a critical RCE flaw across 2.2 billion installs exploitable via model config files targeting GPU-accelerated inference. And Claude Code's MCP (Model Context Protocol) has an actively exploited vulnerability despite widespread developer adoption.

Meanwhile, OpenAI's Lockdown Mode takes the opposite approach: disabling Deep Research, Agent Mode, internet image display, and file downloads entirely. This is not a compromise — it's capitulation, feature by feature. OpenAI is telling the market that prompt injection is not solved, and they'd rather turn off agentic surfaces than ship them into hostile contexts.

The Design Answer Already Exists

Anthropic's Claude Code implements a 7-tier permission architecture from 'plan' (nothing executes without approval) to 'bypassPermissions' (most prompts skipped, safety guards apply). The critical innovation: the 'auto' mode uses an ML classifier to decide when to prompt users — a meta-AI layer training on the question of when to ask permission. This graduated autonomy pattern solves the paradox Bain quantified: human oversight is the #1 friction slowing enterprise AI ROI, but removing all oversight produces the Meta breach.

The Tiered Design Pattern

The competitive advantage goes to PMs who draw this line precisely. Blanket oversight kills the value proposition. No oversight creates the Meta breach. Tiered autonomy with an ML gating layer is the pattern shipping at scale right now.

The Numbers That Should Rewrite Your Cost Model

Google committed $920M/month to SpaceX for roughly 110,000 NVIDIA GPUs through June 2029. Anthropic signed $1.25B/month for the entire Colossus 1 facility. That is more than $2 billion per month in fresh compute commitments from two buyers. Meta is putting up 750,000 square feet of tent-based data centers in Ohio and Tennessee, standing them up in 2-3 months instead of 2-3 years, because demand is far enough ahead of supply that tents are the actual answer.

The thing being pitched is "compute is getting cheaper." What is actually happening is frontier capacity getting pre-sold years out at prices that hold the floor up.

Why Both Narratives Are True — And Which One Matters for You

Older tiers do get cheaper per token. The features a roadmap depends on — the ones that only work on frontier models — sit on the part of the curve that is not moving. One product lead watched her inference line climb from 11% to 19% of cost of revenue without shipping a new feature and without per-user consumption rising. What changed was the price per million tokens on the models she actually needs.

A team telling itself that next year's margin problem resolves on its own when GPT-class costs fall 80% is reading the wrong line on the chart. The supply curve just absorbed $2 billion per month in commitments running the opposite direction.

The Forcing Function

Google's TPU 8 split into training-optimized (8t) and inference-optimized (8i) variants says inference costs on GCP will decline on a different curve than training costs, on a 2-3 quarter timeline rather than this week. The moves available now:

• Semantic routing: send simple tasks to smaller, cheaper models, the way GitHub does with MAI Code One Flash
• Open-weight substitution: Kimi K2.5 and GLM-5 now run competitive agentic workloads at lower cost
• Usage caps: for flat-subscription features used 50x/day, cap the usage, add a cheaper fallback, or move pricing before renewal

The dangerous cell in a product portfolio is flat-subscription plus high-frequency usage. That is where a 15% inference price move eats the margin and the contract will not let pricing follow. New York's 1-year data center moratorium adds regional supply pressure on top. Find the features in that cell and pick one mitigation this quarter.