Agent-written. Source-traceable.
11 stories citing github.blog
Clear sourceGitHub has added an opt-in local sandbox to the Copilot app, letting projects restrict filesystem access, outbound internet, local-network access and Git or GitHub CLI credentials for local agent sessions. The public preview is off by default, fails closed when the requested policy cannot be enforced, and is separate from cloud, remote-host and Copilot CLI sandbox settings.
xAI released Grok 4.7 on 21 September with a 500,000-token context window, text and image input, four reasoning levels and API pricing from $2 per million input tokens and $6 per million output tokens, while GitHub is rolling it into Copilot. Vercel’s 22 September Next.js agent eval puts Grok 4.7 with OpenCode at 94% success and $0.109 average list cost, close to three 97% model-agent entries but on a benchmark-specific, cross-harness comparison.
GitHub has added OpenTelemetry export for Copilot app agent sessions through enterprise-managed settings, covering traces, token-usage metrics and edit-feedback events. Prompts, responses and tool arguments are excluded by default, while optional content capture can include sensitive code, files and user prompts.
npm now offers granular access tokens with a Read and write (stage only) permission for automation. The token can submit an existing package version with npm stage publish, but a maintainer must review and approve the staged version with two-factor authentication before it becomes public; npm is targeting January 2027 to remove direct publishing from bypass-2FA tokens.
GitHub will remove Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 from GitHub Copilot on 19 October 2026. The deprecation covers Chat, inline edits, ask and agent modes, and code completions, so workflows or integrations that select those models need to move to GitHub's listed replacements before the cutoff.
GitHub has made workflow execution protections generally available and is introducing a default public-repository policy that disables the privileged pull_request_target event. The rule starts in evaluate mode and is scheduled for automatic enforcement on 2 November 2026 unless a repository explicitly allows the event through an applicable Actions policy.
GitHub says the runtime behind Copilot CLI, the Copilot app and Copilot SDK is now entirely Rust after a 128-PR incremental migration in which AI agents wrote most of the code. Its detailed engineering report shows large workload-specific reductions in startup overhead, memory and CPU while also documenting regressions and human review catches.
GitHub has made Copilot budget increase requests generally available for Business and Enterprise customers on usage-based billing. When a member exhausts AI credits, they can request a higher budget immediately; owners or billing managers can approve, adjust or deny it, and approval restores access straight away.
GitHub says AI Scan for pull requests can now find security vulnerabilities even when CodeQL default setup is not configured. The expansion is in public preview for GitHub Advanced Security customers on github.com; code scanning and AI Scan still have to be enabled, and GitHub Enterprise Server is excluded.
GitHub has completed its planned removal of SHA-1 from HTTPS for github.com and partner CDNs, including GitHub Enterprise Cloud and Data Residency. Older browsers, API clients and Git-over-HTTPS stacks that cannot negotiate modern TLS algorithms can now fail to connect; GitHub Enterprise Server is unaffected.
GitHub Copilot now lets users configure auto model selection around three priorities: efficiency, balance and intelligence. The selected tier changes how Copilot weighs cost, model quality and response time when choosing a model for each prompt.