10 GitHub Universe 2026 sessions not to miss

The 10 GitHub Universe 2026 sessions we recommend for platform, DevOps, and security teams cover software supply chain security for npm and GitHub Actions, guardrails for AI agents, agentic workflows at scale, and enterprise AI adoption. GitHub Universe 2026 runs October 28–29 at Fort Mason Center in San Francisco, with a free virtual pass for online attendees.

GitHub Universe 2026 at a glance: dates, location and agenda tips

More than 6,000 developers, platform engineers, and security leaders are heading to Fort Mason Center for GitHub Universe 2026. This year's theme is the agentic era, and the big question isn't whether to bring AI into the software development lifecycle. It's how to do it at scale, with trust built in from the first commit.

With 100+ sessions across two days, there are a lot of options. We've picked the 10 talks we think platform, DevOps, and security teams will get the most from. Cloudsmith will be in the Festival Pavilion all week, so come and find us between sessions.

📍 Fort Mason Center, San Francisco, CA 👋 Festival Pavilion (look for the Cloudsmith coffee cart) 🗓️ October 28–29, 2026

Our top 10 picks

1. What happens behind the scenes when you run npm install

• Date/Time: Wednesday, Oct 28 | 4:30 PM - 5:10 PM PDT
• Speakers: Karen Li and Leo Balter, GitHub
• Theme: Supply chain security

Most people run npm install dozens of times a day without a second thought. Karen Li and Leo Balter from GitHub will trace those dependencies back through the people, permissions and release processes that publish and protect them. Expect a clear look at what npm audit can't catch, and where package provenance and OpenID Connect (OIDC) fit in.

This is our top pick because software is assembled more than it's authored, and every install is a trust decision. Knowing how a package reaches your build is the first step to governing it. If you leave this talk wanting to control what enters your environment before it arrives, come and see us in the Festival Pavilion.

View session details

2. Disrupting supply chain attacks: A threat framework for GitHub Actions

• Date/time: Wednesday, Oct 28 | 2:30 PM - 3:00 PM PDT
• Speakers: Steve Glass and Greg Ose, GitHub
• Theme: Supply chain security, CI/CD

A workflow with access to credentials and the power to publish a release is a high-value target for attackers. Steve Glass and Greg Ose will map known supply chain attack techniques to the GitHub Actions controls that stop them, across three layers: the Actions ecosystem, the workflow attack surface, and runner infrastructure.

For platform teams, this is a practical framework for deciding where defenses belong in a pipeline you'd trust with a release. Incidents like tj-actions showed why the build pipeline is a critical control point. This session moves the conversation from what went wrong to what good looks like.

View session details

3. Open pull requests, don't merge them: Fine-grained authorization for hosted MCP servers

• Date/time: Thursday, Oct 29 | 10:30 AM - 10:45 AM PDT
• Speaker: Nick Taylor, Pomerium
• Theme: Agentic security

Hosted MCP servers often enable agents to do everything a human can do. Nick Taylor will demo an identity-aware proxy that adds per-identity authorization in front of any hosted MCP server, with no upstream changes. The live demo shows Copilot opening a pull request and leaving the merge to a human reviewer.

We love this session because it treats guardrails as infrastructure, not an instructions file the agent might ignore. The same principle applies to dependencies. Agents move fast, so the controls around them need to be machine-enforceable and in place before the agent acts.

View session details

4. From writing code to managing agents: Scaling 50+ services at GitHub

• Speaker: Anjuan Simmons, GitHub
• Theme: Agentic workflows, platform engineering

GitHub's Lifecycle team swapped hand-coded fixes across 50+ services for an agentic pipeline. AI agents classify issues, research codebases, write implementation plans, and open draft pull requests. Anjuan Simmons will share the real numbers, how the team built it with GitHub Actions and Copilot, and why engineers still write some code by hand on purpose.

This is a look at agents running in production at platform scale. For engineering leaders weighing the same move, it's a grounded blueprint for where automation pays off and where humans stay in the loop.

View session details

5. Treat your AI context as infrastructure

• Date/time: Thursday, Oct 29 | 1:00 PM - 1:40 PM PDT
• Speaker: Christopher Harrison, GitHub
• Theme: Platform engineering, developer experience

Having the right context is critical for getting your agents to generate useful output. In this session, Christopher Harrison will break down what custom agents, agent skills, instructions files, MCP servers, extensions, and plugins each do best, and how to choose between them for real use cases. He’ll discuss strategies for how to distribute the right context consistently across a team as your setup grows.

Platform engineers already know this story. Anything that works for one developer but can't be versioned, shared, and governed becomes sprawl. This session applies golden path thinking to AI context, and it's a natural fit for teams looking to build those paths for their developers.

View session details

6. Beyond pass or fail: How agents verify AI-generated code

• Date/time: Thursday, Oct 29 | 9:00 AM - 9:40 AM PDT
• Speaker: Jeff An, Momentic
• Theme: AI-assisted testing

The tests passed, so why is the app still broken? Jeff An will show how agents investigate applications, reproduce unexpected behavior, and tell real product bugs apart from flaky tests or infrastructure failures. He'll also cover the deterministic controls that limit what those agents can do while they investigate.

As AI writes more of our code, verification becomes the bottleneck. This talk looks at earning the trust that speed requires, with clear boundaries on what agents are allowed to touch.

View session details

7. The 2 a.m. RCA agent: Architecting AI that investigates, not hallucinates

• Date/time: Thursday, Oct 29 | 9:30 AM - 9:45 AM PDT
• Speakers: Achin Gupta, Intuit, and Divya Mahajan, Amazon
• Theme: Reliability, AI operations

Anyone who has had to spend hours late at night researching root cause analysis (RCA) will want to attend this one. Achin Gupta and Divya Mahajan will present a RCA architecture where deterministic code handles signal collection, topology traversal, correlation, and scoring. The language model only narrates evidence it didn’t have to collect.

The result is a clean split of responsibilities where the machine-enforceable parts stay deterministic, and the model adds clarity where needed. SREs and platform teams will leave with a design they can borrow.

View session details

8. Building AI fluency at UPS

• Date/time: Wednesday, Oct 28 | 11:30 AM - 12:10 PM PDT
• Speaker: Jared Hatfield, UPS
• Theme: Enterprise AI adoption

Getting developers to try Copilot is the easy part. Getting them fluent – using agents to plan, write, and ship real work – is harder. Jared Hatfield will share how UPS moves developers from awareness to fluency, why motivation and measurement matter as much as tooling, and where to focus first at enterprise scale.

For VPs of Engineering and platform leads rolling out AI across large organizations, this is a candid view from a team doing it today. Adoption at this scale also means more packages, pulled faster, by more people and agents. It's worth planning the controls alongside the rollout.

View session details

9. Code is the easy part: Building Home Assistant in the open

• Date/time: Wednesday, Oct 28 | 2:10 PM - 2:25 PM PDT
• Speaker: Franck Nijhof, Open Home Foundation
• Theme: Open source

Home Assistant builds everything in the open, from ideas and UX to architecture and the roadmap itself, across 20,000 contributors and a dozen GitHub organizations. Franck Nijhof will show how the Open Home Foundation runs its whole roadmap through issues, projects, and discussions, including being wrong in public and fixing it in public.

Open source is the foundation for every modern software supply chain. This session is a great reminder of the people and process behind the packages we all depend on, and what it takes to run a healthy project at scale.

View session details

10. The view from the labs: What's next for AI-assisted development

• Date/time: Thursday, Oct 29 | 9:00 AM - 9:30 AM PDT
• Speakers: Cara Phillips, Anthropic; Rohan Varma, OpenAI; Kate Catlin, GitHub
• Theme: The future of AI-assisted development

To close out our list, an interactive panel with leaders from the labs that power GitHub Copilot. Cara Phillips, Rohan Varma, and Kate Catlin will take a candid look at the next two years of AI-assisted development, and what it means for the people building software.

AI changes the laws of physics for how fast teams can move. Hearing where model capabilities are going next will help platform and security teams plan the guardrails that let developers and agents keep that pace.

View session details

Find Cloudsmith in the Festival Pavilion

Between sessions, come and say hello. Cloudsmith is a Gold sponsor at GitHub Universe 2026, and you'll find us in the Festival Pavilion throughout expo hours on October 28 and 29.

• Coffee's on us: Grab a drink from the Cloudsmith coffee cart and refuel before your next session.
• See it live: Watch how Cloudsmith acts as the control layer for your software supply chain. Govern every package, container, and ML model that enters your environment, enforce policy-as-code at first pull, and publish straight from GitHub Actions with OIDC (no long-lived API keys).
• Talk to the team: Bring your questions about AI coding tools, dependency governance, or moving off a self-hosted artifact server. Our engineers are happy to dig in.

Join us for DevOps on Draft: A Universe Git-Together

Wrap up day one with us. On Wednesday, October 28, from 6:00 to 9:00 PM, Cloudsmith is hosting a happy hour at San Francisco Brewing Company, co-sponsored by Tailscale, Eficode, Octopus Deploy, and Chainguard. Expect good beer, good company, and plenty of conversation about what everyone saw that day. Spaces are limited, so register for the Git-Together here.

AI is changing how fast teams build software, and that's exciting. We'll see you in San Francisco to talk about keeping that speed with clarity, control and confidence.