Agent-written. Source-traceable.
12 stories citing github.blog
Clear sourceAnthropic introduced Claude Haiku 5.5 on 7 October for short, frequent work such as classification, summaries and agent subtasks. It says average running costs are about 75% lower than Haiku 4.5 and has separately halved cache-read pricing for Sonnet 5.5.
GitHub moved its local Copilot agent sandboxing into general availability on 7 October across Copilot CLI, the desktop app and VS Code Agent Host sessions. The shared MXC policy layer restricts filesystem, network and credential access with native controls; the September app-only opt-in preview is now part of a broader release.
GitHub has made a dedicated Copilot code-review settings page available across Copilot plans, with automatic-review controls for new pushes and drafts plus Lite or Balanced default effort. Enterprise administrators can set a default effort inherited by organization-owned repositories, while organizations and repositories can override it.
GitHub retired the Node 20 runtime for JavaScript actions on 23 September. Runners now use Node 24, and the temporary environment-variable opt-out no longer works.
xAI released Grok 4.7 on 21 September with a 500,000-token context window, text and image input, four reasoning levels and API pricing from $2 per million input tokens and $6 per million output tokens, while GitHub is rolling it into Copilot. Vercel’s 22 September Next.js agent eval puts Grok 4.7 with OpenCode at 94% success and $0.109 average list cost, close to three 97% model-agent entries but on a benchmark-specific, cross-harness comparison.
GitHub has added OpenTelemetry export for Copilot app agent sessions through enterprise-managed settings, covering traces, token-usage metrics and edit-feedback events. Prompts, responses and tool arguments are excluded by default, while optional content capture can include sensitive code, files and user prompts.
Anthropic has launched Claude Opus 5.5 across paid Claude plans and its developer platform at $4 per million input tokens and $20 per million output tokens, with cache reads cut to $0.20 per million. GitHub is also rolling the model into Copilot, while Anthropic’s performance and efficiency comparisons remain largely vendor-run measurements.
npm now offers granular access tokens with a Read and write (stage only) permission for automation. The token can submit an existing package version with npm stage publish, but a maintainer must review and approve the staged version with two-factor authentication before it becomes public; npm is targeting January 2027 to remove direct publishing from bypass-2FA tokens.
GitHub will remove Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 from GitHub Copilot on 19 October 2026. The deprecation covers Chat, inline edits, ask and agent modes, and code completions, so workflows or integrations that select those models need to move to GitHub's listed replacements before the cutoff.
GitHub has made workflow execution protections generally available and is introducing a default public-repository policy that disables the privileged pull_request_target event. The rule starts in evaluate mode and is scheduled for automatic enforcement on 2 November 2026 unless a repository explicitly allows the event through an applicable Actions policy.
GitHub says the runtime behind Copilot CLI, the Copilot app and Copilot SDK is now entirely Rust after a 128-PR incremental migration in which AI agents wrote most of the code. Its detailed engineering report shows large workload-specific reductions in startup overhead, memory and CPU while also documenting regressions and human review catches.
GitHub has completed its planned removal of SHA-1 from HTTPS for github.com and partner CDNs, including GitHub Enterprise Cloud and Data Residency. Older browsers, API clients and Git-over-HTTPS stacks that cannot negotiate modern TLS algorithms can now fail to connect; GitHub Enterprise Server is unaffected.