GitHub Copilot remains the most widely adopted AI coding assistant. Its evolution from autocomplete tool to full agent platform — with coding agents, agent mode, and multi-model support — has kept it firmly in the Adopt ring.
Architecture Deep Dive → GitHub Copilot Architecture Breakdown — three-tier client/proxy/LLM architecture, hybrid RAG retrieval strategy, multi-model routing, and how the coding agent differs from the inline completion engine.
Why It's in Adopt
Copilot's 2025–2026 evolution has been significant:
- Copilot Coding Agent: Assign Copilot to a GitHub issue and it creates a PR autonomously in a sandboxed cloud environment. This absorbed the earlier "Copilot Workspace" concept.
- Agent mode in VS Code: Multi-step agentic tasks directly in the editor — file edits, terminal commands, and iteration loops.
- Multi-model support: Copilot now uses both OpenAI and Anthropic Claude models, selecting the best model for the task.
- Custom Agents (Oct 2025): Create named, role-specific agents at
.github/agents/AGENT-NAME.md— callable as@test-agent,@docs-agent,@lint-agent,@api-agentetc. Each has its own persona, commands, and three-tier boundaries (always / ask first / never). Composable as a specialist team. Copilot can bootstrap the file for you: open a new file at.github/agents/test-agent.mdand describe what you want. See the GitHub blog post by Matt Nigh (Nov 2025) for patterns from 2,500+ agent files. gh skillCLI (April 16, 2026): The newgh skillcommand lets users discover, install, manage, and publish agent skills from GitHub repositories. Skills follow the open Agent Skills specification and are portable across agent hosts (Claude Code, Cursor, Codex, Gemini CLI, and others).gh skill publishvalidates against the spec and checks repository security settings. Requires CLI v2.90.0+.- Cloud Agent custom properties (April 15, 2026): Enterprise admins can now selectively enable CCA access on a per-organization basis via custom properties, giving finer-grained control over which teams can use cloud agents.
- Data residency (April 2026): Copilot now supports data residency for US and EU regions, ensuring all inference processing and associated data stay within designated geographies — a key compliance requirement for regulated industries.
- Copilot Extensions: Third-party integrations that extend Copilot's capabilities.
- Inline completions: The original feature — still excellent, still the reason most developers start using Copilot.
August 2026: Persistent Context and Sandbox Policy
GitHub Copilot for JetBrains now supports persistent memory across agent-chat sessions, Ollama as a BYOK provider, server-managed controls for plugins, MCP access, permission bypass, and OpenTelemetry, plus Codex-session debug logs and instruction/skill customization. Memory is user-manageable in Copilot settings; teams should decide which project facts and preferences may persist before enabling it broadly rather than treating cross-session retention as harmless chat history. (GitHub changelog)
Copilot CLI 1.0.79 is a larger operational release: enterprise policy can permit auto mode while blocking full allow-all, managed sandbox policy can enforce a proxy, macOS nested read-only paths remain read-only, and /sandbox policy exposes effective paths, network access, and denials. It also adds concurrent-session management, worktree base selection, queued prompts, Agent Plugin extensions, and automatic plugin updates. Two configuration changes require migration: sandbox.gitAuth/sandbox.ghAuth move under sandbox.auth, and allowDevToolCaches becomes allowDevToolAccess; the old keys are ignored, so an existing restrictive policy can silently revert to defaults until renamed. (Copilot CLI v1.0.79)
Agent Plugins 1.0 is now generally available across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app on every Copilot plan. One package can carry portable Agent Skills and MCP server configuration while keeping Copilot-only agents, commands, hooks, rules, and canvases under com.github.copilot/. Business and Enterprise administrators can reuse managed plugin and marketplace settings across clients, but MCP server allowlists remain a separate enforcement layer; teams should govern both the package source and every server the package activates. (GitHub changelog)
On August 21, 2026, GitHub brought the agent into the chat surfaces where teams already coordinate work. The new GitHub integration for Slack (public preview, GitHub as launch partner for Slack Code) lets you mention @GitHub in a direct message, channel, or thread to start a Copilot cloud-agent session that can answer questions about code and GitHub activity, triage or file issues, investigate failures, implement changes in a secure cloud sandbox, and open a pull request with a link back to the conversation. Sessions are shared and multiplayer — anyone in the channel can follow the plan, inspect diffs, add context, redirect the approach, or stop the session — and Copilot continues working asynchronously while you're away from the keyboard. The same model now works in Microsoft Teams (public preview): mention @GitHub in a channel, thread, or meeting chat to turn discussion into an agent session, with anyone having write access able to trigger changes and the whole team able to watch and steer live across surfaces. Issues and PRs created from conversation are attributed to the Copilot app identity, and repository administrators can require an additional human approval on Copilot-attributed PRs before they merge (two approved → three with this enabled), keeping a human gate on agent-authored work. Copilot cloud-agent sessions in Slack are available on Business and Enterprise Copilot plans and consume existing Copilot entitlements and cloud-agent budgets; Teams sessions are in public preview on paid Copilot plans with cloud-agent AI credits and separately billed cloud-sandbox usage governed by usage-based budgets. Ready-to-upgrade consideration: teams evaluating "agent in the room" workflows now have an officially supported path inside Slack and Teams rather than bolting on bot plumbing, but the cloud-sandbox, credit-billing, and approval-gate configuration should be understood before opening it to a whole organization. (GitHub: Copilot in Slack, GitHub: Copilot in Teams)
Pricing (as of March 2026)
| Plan | Price | Key features |
|---|---|---|
| Free | $0 | Limited completions and chat |
| Individual | $10/month | Full completions, chat, agent mode |
| Business | $19/month/seat | Organization policies, SSO, audit logs |
| Enterprise | $39/month/seat | Fine-tuned models, knowledge bases |
Security Considerations
AI-generated code frequently introduces vulnerabilities that traditional scanners miss — Veracode's 2025 report and CodeRabbit's 2025 data (1.7x more issues in AI-coauthored PRs on average) both confirm this. Copilot's popularity means this is a significant surface area for many teams. Copilot's own Security Review feature (added October 2025) partially addresses this: the coding agent now runs CodeQL analysis, dependency scanning, and secret scanning on its own output before opening PRs. But it's still maturing — early versions primarily caught low-severity style issues, and LLM-only review without deterministic tools has documented blind spots for SQLi, XSS, and insecure deserialization.
Recommended: treat Copilot's security review as a floor, not a ceiling. Layer it with a dedicated SAST tool (Semgrep, CodeQL, Snyk Code) for security-sensitive changes. See the Security radar for detailed assessments.
When NOT to Use Copilot
- You need the strongest autonomous coding performance. Copilot's coding agent is good but trails Claude Code (80.8% SWE-bench) on complex, multi-file tasks. For tasks where first-attempt success rate matters most, Claude Code or Codex may be better choices.
- You're on GitLab or Bitbucket. Copilot's agent features are deeply integrated with GitHub. The IDE extensions work elsewhere, but the coding agent and PR workflows don't.
- You want to control your model routing. While Copilot offers multi-model support, GitHub decides the default routing. For teams that need guaranteed model selection per-task (e.g., always use Claude Opus for security reviews), Cursor or Claude Code offer more control.
- Cost sensitivity on large teams. At $39/seat/month for Enterprise across 500 engineers, that's $234K/year. If most of your team uses completions (not agent mode), the $10/month Individual plan covers the primary use case at a fraction of the cost.
Key Characteristics
| Property | Value |
|---|---|
| Interface | VS Code, JetBrains, Visual Studio, Neovim, Xcode |
| License | Proprietary SaaS |
| Underlying model | OpenAI (GPT-5.4, GPT-5, GPT-4.1, o3-mini) + Anthropic (Claude Opus 4.7, Opus 4.6, Sonnet 4.6, Haiku 4.5) + Google (Gemini 3.1 Pro, 3 Flash) + xAI (Grok 4.1 Fast, experimental) |
| Pricing | Free, Individual $10/month, Business $19/month/seat, Enterprise $39/month/seat |
| Agent features | Coding Agent (cloud), Agent Mode (local) |
| Provider | GitHub (Microsoft) |
| Website | github.com/features/copilot |
| Docs | docs.github.com/copilot |