GitHub officially makes Copilot Fusion available at Universe 2026, and opens public beta of Copilot…

GitHub announced the general availability of Copilot Fusion, which integrates automatic model selection and multi-model collaboration, in conjunction with "GitHub Universe 2026" held on October 28 and 29, 2026. In the GitHub Copilot app for desktop, it began the public preview of Projects, which brings together materials and agent work. In addition to new features and general availability for automation, code review, and security measures, it also announced changes to the GitHub Enterprise contract model and the foundations of Git and Actions.

GitHub Universe 2026: Evolving every layer of the stack - The GitHub Blog

This announcement includes not only public previews of new features but also general availability of existing previews and expansion of supported tools and execution environments. Below, we introduce the main changes in order, from the entry point for delegating work, to model selection, knowledge handover, automation, and confirmation of results.

GitHub Universe 2026, Day 1 Opening Keynote

A development vision connecting planning to release

At Universe 2026, GitHub presented its vision for a "software delivery system" that connects planning, implementation, verification, and release. What it emphasizes as outcomes is finishing and delivering changes to users, such as feature additions, bug fixes, and security fixes. Developers set direction, make decisions, and take responsibility for those outcomes. Agents implement and verify changes.

The stages do not necessarily proceed in a fixed order. Code changes, requests from colleagues, production environment metrics, and other triggers can start work at various stages, and developers and agents move back and forth between stages according to the task. The information gained there is used for continuous learning, leading to improvement of the next work.

GitHub cites the following three points as important in this vision.

Velocity: Reduce the time and cost to turn ideas into finished software, and increase efficiency.

Intelligence: Combine information about development on the platform, continuously learn from past work, and improve the next work.

Quality: Ensure safety from the start and find defects before release.

GitHub is also making the technology underpinning its products available so developers can build their own mechanisms. For example, the already-provided Copilot SDK allows embedding a common agent execution foundation into one's own applications. It says developers can decide which work to delegate to agents, which tools to use, and how much to spend.

Start work with Copilot, connecting tools and deliverables

Bring together materials and agent work in Projects

Projects in the GitHub Copilot app is a feature that brings related materials, repositories, agent work, and deliverables together in one place. When you communicate what you want to achieve, Copilot coordinates the necessary work. It has begun offering this as a public preview.

Copilot Projects 📋

Bring sessions, pull requests, and repositories together around one goal. Copilot Projects gives you one place to see where the work stands and direct what Copilot takes on next.https://t.co/4DDsl7Euf1 pic.twitter.com/fwCwfAbYHE— GitHub (@github) October 28, 2026

A session is the unit for delegating individual work to an agent. In Projects, you run the sessions needed according to the goal and manage them together with related materials, deliverables, and recurring work. For example, you can handle a series of work: researching customer feedback, considering improvement proposals, and proceeding to implementation. If the target and work are fixed, such as fixing a specific bug, you can also start a session directly from a repository or folder without creating a Project.

Projects are created from the "+" next to "Projects" in the sidebar. Instead of using the options on the start screen, you can begin by writing your goal or first request directly in the input field at the bottom. You can also pass a local folder from the "+" in the input field. Specifying a folder or repository is not required; if you use a repository on GitHub, search for and add it by owner name or repository name.

Figure 1: The screen with a new project opened in the GitHub Copilot app. Pressing the "+" next to "Projects" in the sidebar adds "New project," and the start screen appears in the center. "Start with one or more repositories" is the entry point for adding repositories on GitHub, "Work on parallel tasks" for running work related to Issues and PRs in parallel, "Triage recent issues" for checking and organizing recent Issues, "Automate routine work" for regularly executing repetitive work, and "Research and work with docs and messages" for research using information from files, chats, and meetings. On the right side, "Overview" lets you check progress. When I asked it to grasp the contents of a local folder, the temporary name "New project" automatically changed to a project name matching the contents.

When you give the created project a goal and the necessary materials, Copilot runs multiple agents in parallel as needed and coordinates the work. It can also handle changes spanning multiple repositories. Even without continuously giving instructions to each session, users can check the progress of the entire project and get involved in the necessary decisions and reviews.

Library is the place to save and check, within a project, materials added by users and deliverables created by agents. If the Library tab is not visible, press the "+" at the top of the right panel and select "Library" under "Open tabs" in the menu to open it.

When I passed a local folder from the "+" in the chat input field, "Attached in chat" also appeared in Library. Opening that folder let me check the list of manuscripts, reference materials, and images inside.

For work using materials, for example, you can pass a feature specification and customer feedback and ask it to classify the problems and list items to investigate next. Saved materials and deliverables can also be used when continuing work in the same project. From the project conversation, you can also set up recurring work such as weekly summaries of materials.

Progress is checked in Overview. It separately displays work requiring user decisions or reviews, open pull requests (PRs), work in progress, and completed work, and you can also send additional instructions to individual sessions.

Creating projects and adding materials can be checked in the official Projects documentation.

Continue the same cloud session even when switching devices or tools

The places where you can continue work are also expanding. GitHub is gradually starting general availability, from the 28th, of a feature that lets paid Copilot plans use the same cloud session across devices and tools. It can be accessed from github.com, GitHub Mobile, the GitHub Copilot app, the CLI, VS Code, and more, so you can check on a PC work requested from a smartphone and give additional instructions. Meanwhile, the agent continues working in the cloud.

By default, this cloud session runs in a cloud sandbox managed by GitHub. When the sandbox stops, the work state is saved as a snapshot, and the session can be resumed later. However, when using Actions self-hosted runners or copilot-setup-steps.yml, you need to choose Actions as the session execution environment rather than the cloud sandbox.

In addition to the fees for paid Copilot plans, cloud sandbox compute resources will also be subject to usage-based billing starting in November 2026. Even if you do not run Actions workflows, usage is counted when you use the cloud sandbox. However, since the shared included usage allowance with Actions can be applied, no additional charges for compute resources will be incurred as long as usage stays within the allowance[1]. Usage beyond that is handled according to pricing, budget, and payment settings.

In VS Code, consolidate the work and results of multiple agents for review

VS Code is adding features for delegating work to agents and checking their progress and results. "VS Code Wrapped," published on the 28th, looks back on a year of updates since the previous Universe alongside this announcement.

For the execution environment, in addition to the cloud, you can choose your own PC or a machine you connect to. The new Agent Host separates sessions from individual windows, so work continues even if you close the window. However, when running on a local or remote machine, that machine and the Agent Host must be running.

A harness is an execution foundation that advances an agent's processing and enables the model to use the tools and information needed for the work. In VS Code, the Copilot harness based on the Microsoft Copilot SDK has become the default for new sessions started in the editor and the Agents window. It uses a common foundation with the CLI and the GitHub Copilot app, reducing differences in agent behavior across products. Claude and Codex harnesses are also available through the Agent Host, allowing VS Code to handle sessions that use their respective execution foundations and features.

In the Agents window, you can run multiple sessions in parallel and review progress and changes together. When you need to edit or debug code, you can move to the editor while keeping the same Copilot session, and then return to the Agents window. It also offers "Compare Models" as a preview, which assigns the same task to multiple models or harnesses and compares the results side by side.

Ways to review and correct work results are also expanding. "VS Code Wrapped" introduces features added so far, including an integrated browser that lets users and agents view and operate the same page, and a Markdown editor that lets you directly edit displayed plans and documents and leave comments for agents.

Canvases is a preview feature that opens an operable screen next to the chat so that users and agents can view and update the same information. For example, a user can move cards on a kanban-style board, and an agent can break down the work and add cards. It targets local sessions using the Copilot harness in the VS Code desktop version. Enable "chat.canvases.enabled," start a new session, and request the necessary screen with "/create-canvas"; the agent then creates an extension for the canvas and opens that screen.

Among IDE updates, GitHub also announced general availability of local sandboxes and Next edit suggestions, which show the next edit candidate, for JetBrains.

Expanding the scope of work to external services, images, and desktop apps

Connectors for using external service materials and tools from Copilot will also be rolled out sequentially as a public preview for all Copilot plans. GitHub calls MCP servers it has verified "connectors." MCP is a connection method for AI to use external tools and information sources. With connectors, users can connect by selecting a service and signing in, without having to find and individually configure a compatible server.

At launch, it supports 26 services including Slack, Figma, Sentry, and Linear. Once connected, it can be shared across the GitHub Copilot app, CLI, VS Code, the cloud, and GitHub Mobile, with no need to reconfigure the connection for each. In Business and Enterprise, administrators must allow the preview feature.[2]

For image generation and editing, when requested in conversation, the conversation model currently selected calls a dedicated image generation tool that uses "GPT Image 2.5 Flare." A preview of the generated image is displayed in the conversation, and the image is saved to the working folder. It is available in VS Code, the GitHub Copilot app, and the CLI, and was announced as a public preview for Pro, Pro+, Business, and Enterprise. Image generation and editing are priced separately from the conversation model and consume the plan's AI credits according to the number of image tokens.

Computer Use in the GitHub Copilot app and CLI has been available as a public preview on macOS and Windows since October 1. By reading the contents of an app and performing clicks and text input, it can operate desktop apps that lack APIs or MCP. It asks for the user's approval before starting operations, and organizations can disable it in management settings. In the October 28 VS Code announcement, Computer Use for use in Copilot sessions on Agent Host was also announced as an experimental feature.

Leaving plans and research results in Issues with Issue artifacts

Issue artifacts, which allow plans, research results, and similar materials to be added to an Issue as individual artifacts, are now in public preview. In addition to writing explanations in an Issue's body or comments, this feature lets related documents be updated and referenced independently. For example, by attaching an implementation plan and updating its contents as discussion progresses, the plan and change history that the team and subsequent agents refer to can be kept in the Issue.

The artifacts that can be added include Markdown documents for storing such plans and research reports, links to external services, and HTML documents. For links to external services, the URL itself—such as a discussion in Slack or Teams or a published prototype—is registered as a single artifact. HTML documents can handle diagrams, flowcharts, interactive visualizations, and more, and on github.com you can switch between the rendered result and the HTML source to check them.

Artifacts can be created, edited, and deleted on github.com and shared via a link for each artifact. The gh issue artifact command has also been added to the GitHub CLI, enabling agents and development tools to manage artifacts.

Creating prototypes for trying out product screens and interactions with Replica

GitHub has released Replica, developed by GitHub Design, under the MIT license. It is a set of tools for creating and sharing prototypes that let people try out product screens and interactions, and it includes a plugin and app templates for the GitHub Copilot app, a server for sharing, and more. It can be used by designers, product managers, and engineers to turn ideas into something they can actually run and evaluate.

Replica's README describes its main components as follows.

Starters: App templates that serve as starting points for prototypes. They also include common skills for Copilot. Small templates to adapt to your own designs and templates equipped with Microsoft's CoreAI UI components are provided.

Replica plugin: A plugin that adds a Replica canvas to the GitHub Copilot app and displays the running prototype alongside the conversation.

Replica Hub: A sharing server that publishes created prototypes and lets team members interact with them and leave comments. Deploy and operate it yourself as needed.

GitHub build action: A GitHub Actions action for building prototypes to publish to the Hub. It is not needed for local creation.

The provided template is a web app that uses React, a JavaScript UI library, and TypeScript, and it also includes CSS for styling the appearance [3].

Using the template is not mandatory; a method for starting from an existing web app is also described. In that case, keep the existing app's files, structure, and startup method, add the configuration for connecting to the Replica canvas, and check the display.

Once the template or an existing web app is running, prepare the team's UI components, design patterns, and documentation. When you convey the screens and behaviors you want to build in natural language in the GitHub Copilot app, Copilot uses them as clues to edit code and styles and create a prototype. You can try out the behavior on the canvas and make corrections while doing so, and you can start with only your local environment without introducing the Hub.

Select models⁠ and combine them: Copilot Fusion is now generally available

Copilot Fusion is a mechanism for deciding, per task, which AI models to use and how to combine them. It has begun general availability and can be used in VS Code, the GitHub Copilot app, the CLI, and JetBrains IDEs.

Route and orchestrate models with GitHub Copilot Fusion - GitHub Changelog

Its predecessor, Project HydraFusion, began a research preview on September 4, and Max was added on October 14. This time, the conventional automatic model selection and HydraFusion's multi-model coordination have been integrated into Fusion. If you had selected Auto, HydraFusion, or HydraFusion Max, you will automatically be switched to the corresponding Fusion effort level.

Copilot Fusion 🧬

Choose High or Max effort, and Copilot Fusion can coordinate multiple models and workflows when one model alone isn’t enough. In the @ArtificialAnlys Coding Agent Index, Copilot Fusion Max scored within two points of Claude Code with Opus 5.5 Max at about half… pic.twitter.com/QGsBwCkdw1— GitHub (@github) October 28, 2026

Users choose an effort level: Standard⁠, High⁠, or Max⁠

The effort level is a setting that specifies the balance among quality, latency, and cost. According to the Fusion documentation, Standard is for everyday work and uses a single model. High is suited to complex but well-scoped changes, and Max is suited to work requiring deep reasoning or careful analysis, combining multiple models as needed.

In the GitHub Copilot app, click the model name displayed below the input field to open the model selection menu. When "⁠Copilot Fusion" is turned ON, you can choose the Standard, High, or Max effort level; when it is OFF, you can choose an individual model [4]. The model settings selected in the app also become the default for sessions created afterward.

In VS Code, select Fusion from the model selection menu in Copilot's chat input field. [4]

Figure 2: VS Code's model selection menu (left) and the screen for choosing the Fusion effort level (right). Select "Copilot Fusion" and switch among Standard, High, and Max under "Effort Level." In the screen, Standard is selected. The individual model names listed on the left are a list for manual selection and do not indicate the candidates for Fusion selection.

Fusion automatically decides which models to use and how to execute

Fusion decides which models to use according to the effort level selected by the user and the content of the prompt, and automatically chooses the execution method from the following three. The execution method is not something the user specifies directly in a menu, and it may change from request to request even within the same session [6].

Single: A single model handles the task.

Cascade: An efficiency-focused model first produces an answer, and depending on the evaluation result, the processing is handed over to a higher-performance model.

Critique: Multiple separate models examine the initial answer in parallel, aggregate their feedback, and then the original model revises it.

The candidate models are not fixed and are updated as new models appear or according to GitHub's evaluations [5].

Fusion Max achieves strong results on Terminal-Bench 4.0

According to GitHub, Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, within 2 points of the result of using Opus 5.5 Max with Claude Code. It states that the average API cost per task in that evaluation was about half, and the time required was about 40% shorter.

According to an article dated the 28th by Artificial Analysis, which conducted the evaluation, it used the Max setting of Fusion in the GitHub Copilot CLI and calculated an overall score by weighting three benchmarks equally. In the breakdown, it scored 71% on Terminal-Bench 4.0, the highest among the comparison targets listed in the article.

Excerpt of the main configurations of Fusion, Claude, and GPT from Artificial Analysis's Coding Agent Index v2.0 and the evaluation breakdown. Confirmed on October 30, 2026. In all cases, higher numbers indicate better results. These are evaluations combining models and execution platforms.

Execution platform Model / effort level Overall score Terminal-Bench 4.0 FrontierCode v1.1 SWE-Atlas-QnA-AA

Claude Code Claude Opus 5.5 (Max) 62 63% 56% 66%

Claude Code Claude Sonnet 5.5 (Max) 59 66% 48% 64%

Claude Code Claude Fable 5.1 (Max) 58 58% 49% 66%

Codex GPT-6 Astra (Max) 55 56% 49% 59%

Codex GPT-6.1 Sol (Max) 54 53% 49% 60%

Codex GPT-6.1 Terra (Xhigh) 48 46% 45% 54%

In the overall score, Claude Code's Opus 5.5 was higher, and it also surpassed Fusion on FrontierCode and SWE-Atlas-QnA-AA. Codex's GPT-6 Astra and GPT-6.1 Sol also scored higher than Fusion on SWE-Atlas-QnA-AA, showing that strengths differ by evaluation item.

Frontier performance at a fraction of the cost.

In the @ArtificialAnlys Coding Agent Index, Copilot Fusion Max scored within two points of Claude Code with Opus 5.5 Max at about half the API cost per task.

Eligible plans and usage fees

Fusion Standard is available on all Copilot plans, but High and Max are available on Copilot Pro+, Max, Business, and Enterprise.

There is no additional charge for Fusion itself; you are billed according to the rates of each model used. When multiple models are used with High or Max, AI credits may be consumed more than with Standard. On paid Copilot plans, until November 30, 2026, the cost of models used with Fusion is discounted by 30%.

Routing to local models is an experimental preview

In Fusion Standard, a feature for choosing between supported local models and cloud models is also offered as an experimental preview that users enable. It allows you to use the computing resources of your own device without manually switching models for each request. However, because the cloud decides which model to assign processing to, this automatic selection requires an internet connection.

In the GitHub Copilot app, go to "Model providers" in settings, select "Windows ML" from "Add provider," and press "Download" for MAI Code 1.1 Flash to obtain it. Use requires a supported GPU and sufficient memory. Next, enable "Local model auto routing" in the experimental features settings, and when you select Fusion Standard in a new session, local models also become routing destinations.

In the CLI, enable experimental mode and proceed with configuration from "/model." There is also a way to manually configure and use supported models on Windows, macOS, and Linux [7]. In VS Code, enable "chat.copilot.localModel.enabled."

Put past work and related code to use in your next development with GitHub intelligence

GitHub intelligence is a set of features that lets agents use repository code, development history, and team knowledge. In this announcement, GitHub introduced Memory, which carries knowledge over; Dreaming, which reviews that content and work guidelines; and code search across related repositories.

GitHub intelligence puts your code, context, and history to work - GitHub Changelog

Memory becomes generally available; Dreaming preview begins

Memory, which had been in public preview since January, is now generally available, and a public preview of Dreaming has newly begun. Memory remembers personal preferences and repository conventions and makes them usable across other sessions and clients. Dreaming reviews past conversations and work, organizes and updates that memory, and also suggests improvements to the skills and instruction files that agents follow.

Memory is offered on paid Copilot plans. For example, if it remembers test execution commands or how to write PR descriptions, you can reduce the effort of repeating the same instructions in your next task. In addition to users explicitly asking it to remember, Copilot also automatically creates and organizes memories from interactions during a session. In the general availability announcement, GitHub states that memories can be created in the GitHub Copilot app, CLI, VS Code, cloud agents, and code review, as well as in Slack, Teams, and GitHub Mobile.

The scope in which saved information is used differs by its type. Information about a repository applies to work in that repository, while personal preferences are used across repositories. Users and administrators can review and delete saved content according to settings [8].

In reviews by Dreaming, personal and repository memories are added, updated, or deleted as needed. There is also a feature that reflects repeatedly adopted code review feedback into guidelines for future reviews. Changes to skills and instruction files saved in a repository are not applied directly but are proposed as a PR for the team to review [9].

Dreaming must be enabled, and running it uses AI credits. For organizations and enterprises, administrator policies also apply.

Search code across related repositories

GitHub intelligence also has a feature for finding code, configuration, and documentation from multiple related repositories. You can search for strings and symbols without cloning everything locally, and it also supports semantic search that specifies what a process does in natural language.

The announcement gives an example of investigating retry processing that spans a payment service, a shared library, and background processing. When you request it with "/research," it checks the implementation and callers in each repository and can investigate where retries may be duplicated. It can be used to understand the relationships among processes split across multiple repositories before starting changes.

Copilot Automations adds team sharing and improvement support

Manage Copilot Automations as a team

With Copilot Automations, you combine a prompt that instructs the work, start conditions, and the tools you allow it to use, and run Copilot in the cloud. For example, you can set up processes such as trying to reproduce a bug when an Issue is created, or investigating an outage when a notification is received from a monitoring service.

Build shared workflows for your team with Copilot Automations - GitHub Changelog

In addition to the existing personal Automations, shared Automations managed by teams will be rolled out progressively. People with read permission on the repository can view the settings, and people with write permission can edit them. Actions on GitHub are recorded under Copilot's name, and AI credits and Actions execution time are billed to the repository owner. Because shared Automations belong to the repository, the process can continue even if the person who created it leaves the team.

The target plans are Copilot Pro, Pro+, Max, Business, and Enterprise. The announcement states that they can be created in any repository where you have write permission [10]. For organization-owned shared Automations, an administrator setting that permits billing to the organization is also required.

Add start conditions and tools, and suggest improvements from results

Copilot Automations has added 24 GitHub events that can be specified as triggers for execution. You can start a configured process in response to events such as a PR conflict occurring or a security alert being created.

Using the REST API, you can also trigger an Automation from an external system by passing in relevant information. In addition, by making the success or failure of one Automation the start condition of another Automation, you can build multi-stage processes.

The available GitHub tools now include 20 additional ones, such as re-running workflows, merging PRs, and attaching images and videos. You can also connect your own MCP servers, and choose which tools are allowed for each Automation. What can be done with external services also depends on the settings and credentials of the connection destination.

For each Automation, you can set an upper limit on AI credit usage. When the per-execution limit is reached, that execution stops. You can also set daily, weekly, and monthly limits, and when a limit is reached, no new executions start until the next aggregation period begins.

Furthermore, a feature has been added that creates improvement proposals from execution results. If you ask Copilot to create a mechanism that reviews the work you want to automate and its results to improve them, it can combine an Automation for the work and an Automation for improvement.

For example, for PR reviews, you prepare an Automation that checks changes and comments when a PR is created, and an Automation that weekly analyzes how developers responded to those comments and creates proposals for improving the review method. For an Automation that classifies Issues, whether a person corrected the labels it applied is a clue for evaluating the results, and for a performance-improvement Automation, whether the PRs it created were merged is a clue.

When an improvement Automation proposes changes to the prompt, tools, or start conditions of a work Automation, GitHub sends a notification to the user. The user reviews the proposal and chooses whether to accept or reject it, and accepted changes are applied.

VS Code previously supported personal scheduled executions that run locally, but now it also supports creating and managing cloud Automations. Because they run in the cloud, scheduled processes can run even if the PC is turned off. If you enable the setting "chat.automations.cloud.enabled" in VS Code 1.144 or later, you can create and manage them from the "Automations" tab in the Agents window.

Agentic Workflows becomes generally available, managing definitions together with code

GitHub Agentic Workflows is an open-source project that runs coding agents within GitHub Actions, and it became generally available after a public preview in June. When you define the process you want to automate in natural-language Markdown, it is converted into standard YAML for Actions and can be run under existing runner groups and policies. It can be used for organizing issues, analyzing CI failures, updating documentation, creating tests, and more.

Copilot Automations are created and managed from the "Agents" tab of a repository on GitHub, among other places. Settings are not committed to Git as files within the repository; they are stored separately from the code. Agentic Workflows, by contrast, commits both the Markdown definition and the generated .lock.yml, so the automation definition itself is managed in the same history as the code, and changes can be reviewed in a PR.

As updates since the public preview, GitHub cites support for self-hosted environments using Actions Runner Controller and Docker-in-Docker, as well as improvements to AI cost forecasting. The cost forecasting command gh aw forecast has finished its experimental phase. Forecasts now include the AI credits consumed by threat detection, and estimates of monthly AI credit usage are given as a range.

In addition, it is now possible to choose, per workflow, which service to use for models. For example, when running Claude Code, you can choose a configuration that uses Anthropic's API directly, or one that uses Claude models via GitHub Copilot. A mechanism for routing models according to the type and difficulty of the task is also provided.

Options for running agents on lightweight virtual machines and an isolation feature to prevent data leakage when handling multiple repositories are also presented as improvements since the public preview.

The GitHub access permissions of agents running in Agentic Workflows are read-only by default. The execution environment is isolated in a sandbox, and communication destinations are restricted. Writes to GitHub, such as creating issues, go through a mechanism called safe outputs, in which the agent's output is validated and then a separate job with the necessary permissions performs the action. How problems found by threat detection are handled depends on the configured mode[11].

The offering covers GitHub Free, Team, and Enterprise on github.com. The standard Copilot CLI engine requires a Copilot license, and when using other supported engines, you must perform the authentication required for each and meet their terms of use.

Additionally, Actions workflow dependency lockfiles became generally available on the 28th after a public preview on the 14th. This is a separate feature from Agentic Workflows: for actions called from a workflow and the actions those actions depend on, it records the commits to execute in actions.lock. Readable tags and branch names can remain in the workflow. Even if those tags or branches later point to different commits, execution uses the recorded commits, preventing unintended changes in dependencies[12].

Updates to code review and PR/issue management

Max added to Copilot code review, approvals feature generally available

Copilot code review has added Max as a review processing level, following Lite and Balanced, as a public preview. Meanwhile, Copilot approvals, which approves PRs, became generally available after a public preview starting in September.

Copilot code review: Merge with confidence with Max and approvals - GitHub Changelog

In Max, multiple agents using models from different providers review independently. After that, an aggregating agent checks for discrepancies and accuracy in the findings and consolidates them into a single review. Processing takes longer than reviews with Lite or Balanced, and consumes more AI credits. GitHub positions it as a processing level for changes that require detailed verification, such as authentication processing or libraries used by multiple services.

Copilot approvals is disabled by default, but when an administrator enables it, Copilot can approve PRs based on review results. A setting is also available to count those approvals as approvals required for merging.[13] If a new commit is pushed after approval, the approval is revoked, and a new review is required to obtain a new approval. Max and approvals are available on Copilot Pro, Pro+, Max, Business, and Enterprise.

Fix Actions failures and merge conflicts with Agent Merge

Even after review is complete, CI failures or conflicts may prevent merging. Agent Merge, which monitors and fixes these problems, has been integrated into PRs on GitHub, following the GitHub Copilot app and VS Code.

With "Watch and fix" on a PR, select Actions workflow failures, merge conflicts, or both as targets to fix. When the selected problem occurs, Copilot proceeds with fixes in a cloud environment. Furthermore, if GitHub's auto-merge feature is enabled, GitHub will merge once the necessary conditions such as required review approvals and checks are met after the fix. Agent Merge in the cloud is available on paid Copilot plans, and policies configured by organizations or enterprises also apply.

Exemption conditions for PR posting limits and permissions for issue management

In collaborative work management, exemption conditions have been added to the feature that limits the number of PRs from contributors without write permission. Criteria are set based on days elapsed since account creation and the number of the contributor's PRs merged in that repository, and people who meet at least one of the enabled conditions can create PRs beyond the limit. Configure the conditions and threshold values in "Moderation" → "Interaction limits" in the organization or repository settings.

In addition, a Moderate role that allows editing and managing issues without granting access to code was also announced, but according to an addendum dated the 28th, it has not yet been provided and is scheduled to begin being offered within the next few weeks.

Security measures range from local fixes to monitoring public information

GitHub Advanced Security's product lineup is divided into Code Security, which handles code vulnerabilities, and Secret Protection, which prevents leakage of secrets, and each can be contracted separately.

Review local changes and fix existing alerts with the GitHub Copilot app

The Security extension for the GitHub Copilot app is offered as a public preview. It includes a feature to review local changes before opening a PR and a feature to check and fix existing code scanning alerts in a repository.

Security extension for the GitHub Copilot app - GitHub Changelog

Reviewing local changes is available on all Copilot plans and does not require an additional Code Security contract. Search for "github-security" in the app's "Customize" and install it, then request with /security-review. In Business and Enterprise, app usage permissions and plugin restrictions configured by administrators also apply.

To handle existing alerts, code scanning must be enabled in the repository, and the user must have permission to view alerts. For private repositories, a GitHub Code Security license is also required. Within the app, you can request explanations or fixes for alerts, and when fixing, Copilot modifies the local working copy. It does not commit or push, so users can review the changes before applying them.

Explanations, fixes, and reviews of local changes use the model selected in the app and consume AI credits just like regular requests. Viewing or dismissing alerts does not consume AI credits.

Code scanning for AI applications is designed to detect indirect prompt injection, disclosure of sensitive information, excessive granting of permissions to agents, and similar issues. For example, it examines code paths through which instructions in untrusted documents reach an AI that can access external tools or data. When code scanning and inspection for AI applications are enabled, they run in parallel with existing CodeQL analysis when a PR is created and also provide information for addressing detected issues.

In public preview, a GitHub Advanced Security license on github.com is required. According to the official Docs, running inspections also consumes AI credits.

Meanwhile, AI Scan for repositories is a public preview feature that uses AI to examine the latest commit on the default branch. It also targets languages and frameworks that CodeQL does not support, supplementing the detection of vulnerabilities that are hard to find with rule-based analysis.

After enabling AI Scan for repositories, a user with write permission for code scanning starts an inspection from the screen. Inspections have a maximum execution time and focus on locations likely to contain vulnerabilities. Results are displayed in the code scanning alert list, and after a fix is merged, a rescan confirms that the issue is resolved.

AI Scan does not require a Copilot license but consumes Code Security AI credits. For an organization's private and internal repositories, Code Security or Advanced Security is required, and personally owned private repositories are not supported. AI Scan for PR changes became generally available on the 15th, and its enablement settings differ from those of the new repository-oriented feature.

With Dependabot, analyze the possibility of calling vulnerable functions

On October 28, GitHub launched the public preview of Dependabot reachability analysis. This feature searches for call paths from application code to vulnerable functions in dependency packages, showing not only whether a dependency package has a vulnerability but also whether the application is likely to call that location, making it easier to prioritize responses.

The target is JavaScript and TypeScript on GitHub Enterprise Cloud, and npm, Yarn, or pnpm lockfiles are required. The preview period is free, and an Advanced Security license is not required. Actions execution time used for analysis is also not billed. Results are supplementary information for alerts and do not automatically close alerts or determine that no action is needed.

Prevent leakage of secrets and detect leaks to public repositories and Issues

A feature that uses AI to detect secrets and prevent leakage via push has also entered public preview. A dedicated AI classifier examines how candidate secrets are used in the surrounding code and can detect secrets that do not match known string patterns. When it detects one, GitHub rejects the change and indicates the relevant location.

This blocking feature is disabled by default. Both existing push protection and AI-based secret scanning must be enabled, and blocking of AI-detected secrets must also be enabled. It is available to organizations with Secret Protection or Advanced Security on github.com, and AI detection at push time uses AI credits.

Public monitoring, which investigates leaks after publication, became generally available after a public preview that began in July. Enterprises using Secret Protection or Advanced Security on Enterprise Cloud can use it at no additional charge.

It searches for secrets leaked into public content on github.com, including not only repositories owned by the enterprise but also personal forks and writes to public Issues. It uses enterprise member information and verified domains to determine which enterprise to notify of a leak[14].

Prior to general availability, on the 22nd it supported Enterprise Cloud, which lets customers choose data residency, and on the 23rd it added alert management, automatic verification of the validity of leaked credentials, and API/Webhook support. This makes it possible to manage the status of responses after a leak is discovered and to integrate with existing incident response systems via API and Webhook.

Including Copilot usage entitlements in GitHub Enterprise

Until now, Copilot Business and Copilot Enterprise seats were contracted and managed separately from the GitHub Enterprise contract. Now, GitHub Enterprise Cloud has introduced a contract model in which each user's Copilot usage entitlement is included in the GitHub Enterprise license. Initially, enterprises contracting through GitHub or Microsoft sales representatives can use it for new contracts or by migrating from existing contracts.

GitHub Enterprise now includes access to GitHub Copilot - GitHub Changelog

Under this model, the burden of managing Copilot seats and AI usage separately is reduced, and usage is managed around the enterprise's AI budget. The features and models are equivalent to Copilot Enterprise, but monthly AI credits are not included per seat, and AI usage is charged to the enterprise's budget from the first request. Even if the budget is exhausted, code completion and Next edit suggestions remain available, while chat, code review, and cloud Copilot require available budget.

Availability for self-service contracts is planned to roll out gradually, and current self-service contracts are not affected[15].

Updates to the Git and Actions foundations supporting growing workloads

In an article summarizing the Universe announcements, GitHub explained its policy of changing the design of the foundation itself, in addition to increasing capacity, in order to handle the increase in agent-driven development. For the Git foundation, it set out three principles: simplifying components, separating storage and computation, and minimizing coordination processing.

Jay Parikh, who leads CoreAI at Microsoft, explained in a post timed with Universe that the company is investing in the foundation. As one of the ongoing efforts, he cited a new Git architecture capable of handling 180 times the current throughput.

Also, GitHub CTO Vladimir Fedorov, in a post about scaling the Git foundation, asked regarding throughput per repository, "What if we could do 7,200 pushes per second?"

In an environment where agents make changes in parallel, not only code reads but also the concentration of pushes and merges places load on the foundation, so GitHub is redesigning the Git foundation while keeping it running.

Building Git infrastructure for agent-scale development - The GitHub Blog

According to this article, previously a complete copy of a repository was placed on multiple servers and used for both storage and read processing. Increasing read copies also increases the parties that must be coordinated with during writes, making it difficult to scale reads and writes simultaneously.

So in the new design, storage is separated to Azure Blob Storage, and workers handling reads can be scaled independently up and down. During writes, coordination to prevent update conflicts is performed only in the part that updates references such as branches. Data storage and verification can proceed in parallel with other writes, and heavy data organization has been separated from the servers that process normal Git requests[16].

GitHub is migrating its operating foundation to multiple Azure regions, and at Universe it indicated a outlook of completing this migration in early 2027.

Actions distributes targeted Linux jobs across Azure and AWS

Separately from the Git infrastructure changes, GitHub also announced a change to expand GitHub Actions hosted runners across multiple clouds. GitHub Actions will automatically assign eligible Linux jobs to available Azure or AWS execution environments. By increasing the number of execution destinations, it reduces wait times during congestion and shortages of compute resources. Existing runner labels and workflow syntax remain unchanged[17].

The targets are the standard 2-core and 4-core Linux runners and corresponding 2-core and 4-core larger runners that do not have special configurations. Windows runners and runners that use special configurations such as private networks are not eligible. For Free, Pro, and Team, it is automatically applied to eligible runners, while on Enterprise Cloud, administrators enable the use of AWS.

A list of Universe-related announcements can be found under the Universe '26 tag on the GitHub Changelog.