GitHub went dark on Monday for over six hours, dragging Copilot, Actions, and enterprise authentication down with it. By Tuesday morning Cursor was rolling out Origin, a direct GitHub replacement, to paid users. Microsoft picked the same day to fold its consumer and 365 Copilot apps into one super app. The AI developer stack a Jacksonville business signed up for six months ago is being rewritten in public this week, and every hour spent on one vendor's roadmap is an hour you cannot get back when their roof leaks.
The most useful way to read this week's tech news is to picture a Jacksonville accounting firm on Monday morning trying to close July books. The bookkeeper opens her IDE and Copilot is dead. She tries to push a quick script change; the git remote hangs. She checks GitHub Actions to see if last night's data pipeline ran; the status page is red. She tries to log into an internal admin tool that authenticates through GitHub OAuth; access denied. Four different products, one down button. That is not a hypothetical. Monday's GitHub outage lasted more than six hours and took repositories, APIs, GitHub Actions, Copilot, and enterprise authentication services with it in a single sitting. By Tuesday morning Cursor was pushing Origin, its own hosted repo product with pull requests and CI baked in, to paid users. Microsoft picked the same 24 hours to consolidate consumer Copilot and Microsoft 365 Copilot into one app. The overlap of those three announcements is the story. The AI toolchain a Jacksonville business signed up for in the spring is being torn up and re-poured in front of everyone, and every layer that used to be a separate vendor is being pulled inside one roof.
Small business owners tend to treat GitHub, Copilot, and Slack the way a restaurant owner treats a food distributor: reliable enough that you stop shopping around and just place the standing order. Then the truck does not show up. On Monday the truck did not show up for six hours, and the truck was carrying source control, the AI pair programmer, the CI/CD pipeline, and the identity system all at once. That bundling is convenient on the good days. On the bad day it multiplies. If the outage had hit source control only, most teams could have kept moving on local branches. If it had hit Copilot only, everyone would have written a bit slower and lived. Because the same vendor now owns all four layers, the failure cascaded across every one of them. A Jacksonville software shop paying $1,200 a month for Copilot seats got six hours where every seat sat idle, and no separate service the shop could have failed over to.
The reason nobody priced this in is that the bundling happened quietly, over several years, one acquisition and one product launch at a time. Microsoft bought GitHub. GitHub added Actions. Actions became the default CI runner. Copilot became the default AI assistant, deeply hooked into the same auth system. Enterprise SSO started routing through GitHub identity. None of those steps felt like a concentration event on the day they happened. The bill for the concentration arrived Monday. For a Jacksonville small business that runs its entire AI-augmented workflow through one vendor's stack, the operational question is not whether the same thing can happen at Google, at Anthropic, or at OpenAI. Of course it can. The question is how long the outage would last inside your business before someone downstream noticed, and whether you have anywhere else to send the traffic.
The reason Cursor's Origin launch matters is not that Cursor is a better product than GitHub. It probably is not, on day one. The reason it matters is that Origin exists at all, and shipped to paying customers roughly 18 hours after GitHub's status page turned red. The developer coverage this week described Origin as challenging GitHub's 3PC-based Spokes architecture and targeting its horizontal scaling and operational overhead problems. Translation: someone spent a lot of engineering time last year assuming exactly what happened Monday would happen, and built a product that lets a customer walk away when it does. That is what a market response to concentration looks like. It is not a lecture about lock-in. It is a competitor showing up on Tuesday with hosted repos, pull requests, and CI wrapped around their AI coding agent, priced for teams that are already paying for the AI agent anyway.
The same pattern is showing up outside code hosting. Microsoft consolidating consumer Copilot and Microsoft 365 Copilot into a single app on the same day is a bet in the opposite direction: bundle more tightly, make the single app the front door for everything, and let the AI assistant be the interface that eats the surrounding SaaS. TLDR IT called out "AI kills another SaaS tool" in the same brief. Cisco went shopping this week; Dynatrace bet $915 million on AI observability, buying its way into the ability to watch what all these consolidated stacks are doing. Lovable, the vibe-coding platform, raised $400 million at a $13.3 billion valuation for a product that is essentially "the browser plus an AI agent plus a code host." Anthropic pulled in $65 billion in annualized revenue on the back of a coding-agent story. Every one of these moves is a bet that the tooling layer beneath a small business is going to consolidate around a handful of vendors, and that whoever owns the tightest bundle wins. For the Jacksonville business paying the bills, the risk is not which one wins. The risk is being married to the losing one on a 24-month contract when the switch happens.
The counter-move is a portability audit, and it is worth doing before the end of the quarter. Walk the operational stack: source control, AI coding assistant, CI runner, identity, email, calendar, CRM, customer support, analytics, storage. For each layer, name a specific alternative vendor, know what the data export path looks like, know what the contract lets you exit, and know how long a switch would take. If a layer has no named alternative or the switch would take more than a week, that layer is a concentration risk. It does not need to be moved today. It needs to be labelled and rehearsed.
Three procurement rules make sense given how fast the tooling is moving. First, prefer vendors that publish clean data export APIs and treat portability as a feature, not a favor. If a tool locks your data behind a support ticket, that tool is one board decision away from becoming a hostage situation. Ask on the sales call, before you sign, what a full export looks like and how long it takes. If the answer is anything other than "here is the API endpoint," the layer under discussion is a bad bet for the next 18 months of AI churn. A Jacksonville real estate brokerage moving to a new CRM should be able to leave with everything, including notes and email threads, in an afternoon.
Second, build workflows against a routing layer wherever the layer exists. For AI models this is what OpenRouter and its peers do, and Stripe's acquisition of OpenRouter over the weekend made routing the operating standard for the model layer. The same idea applies upstream: use an identity provider you can move (Google Workspace or Okta rather than the SSO baked into whichever SaaS you bought last), use an email platform that supports IMAP export, use a code host that lets you mirror repos to a second remote. Every workflow should have a switch, and the switch should have been tested at least once. A Jacksonville accounting firm running its books through a single AI-augmented SaaS product with no export path is one vendor pricing change from a very ugly quarter.
Third, expect the AI dev stack to consolidate around fewer vendors and pick your one primary and one live backup accordingly. Cursor Origin is not going to displace GitHub this month. But by Q2 next year the market will probably look like two or three integrated code-plus-AI stacks, and the safest position for a small business is to have primary muscle memory on one and a working account with a second. Same rule for AI models, for identity, for cloud infrastructure. The frontier arms race and the consolidation of the working tools are happening at the same time. The businesses that stay flexible will spend the next 18 months buying better tools cheaper. The ones that got married to a single vendor last winter are going to be having very expensive conversations this fall. The Monday outage was the free preview. The paid version arrives whenever the next major vendor has a bad day, and Jacksonville businesses that build a portability audit into procurement this quarter will barely notice when it does.
Monday's outage lasted more than six hours and hit repositories, APIs, GitHub Actions, Copilot, and enterprise authentication services in the same window. The reason those layers all failed together is that Microsoft has spent the last several years bundling them into one platform. When source control goes down, Copilot loses the context it reads from, Actions cannot check out code to run pipelines, and any tool authenticating through GitHub OAuth stops recognizing users. For a Jacksonville small business that treats GitHub as "just the code host," the outage exposed how much the vendor now owns: the AI pair programmer, the CI runner, the identity system, and the source of truth for every project. The operational cost is one down button that turns off four different things at once. That is why the risk needs to be re-priced.
Probably not as a full replacement in the next 30 days. Origin is fresh, its scaling story is unproven at load, and moving a whole operation on day one trades a known problem for an unknown one. The smarter play is to open a paid Origin account, mirror one or two critical repos to it, and get someone on your team fluent enough to run pull requests and CI there in a pinch. When your primary code host has its next bad day, and it will, you already know where the backup lives. A Jacksonville engineering shop can practice the switch on a Tuesday afternoon for the price of an Origin seat and a couple of hours. That is what a portability posture looks like: familiar enough with the second vendor that a real outage is inconvenient rather than existential.
Walk the operational stack layer by layer: source control, AI coding assistant, CI runner, identity and SSO, email, calendar, CRM, customer support, analytics, cloud storage, backup. For each layer write down four things. First, the current vendor and monthly cost. Second, a specific alternative vendor that could serve the same need. Third, the data export path and how long a full export takes. Fourth, the switch time in business days if you had to move. Highlight any layer where the alternative is unnamed, the export path is opaque, or the switch time is over a week. Those are the concentration risks. Rehearse a switch on one of them per quarter. Most Jacksonville small businesses can do the full audit in an afternoon, and the document is the first thing you reach for when a vendor has a bad news week.
On the good days, yes. That is why the bundling happened in the first place. One vendor, one bill, one SSO, one support relationship. The math only works if the bad days stay rare. This week showed how expensive a single bad day can be when the same vendor owns four operational layers, and it happened at Microsoft, which spends more on reliability than most companies spend on everything. Consolidation is a fine default for tools that are cheap to replace and low in criticality. It is a bad default for the layers that would take your Jacksonville business down for a full day if they failed. The right answer is not "no bundling ever." It is a deliberate choice, per layer, with a named backup and a rehearsed switch path anywhere the failure cost is high. Convenience is worth paying for. Being unable to run when the truck does not show up is not.