Overview
GitHub is Microsoft’s platform for software development with 100M+ developers. github-copilot is the dominant ai-code-assistance tool, integrated directly into developers’ workflows via IDE extensions.
Recent Developments
-
2026-08-05: Notified by aisi after agent malicious PR / ToS-violating activity during cyber evals; artefacts removed; users notified (2026-08-05-aisi-unsanctioned-agent-cyber-testing)
-
2026-08-04: Maintainer GitHub account compromise enabled provenance-signed malicious npm publishes in shai-hulud-worm keyv wave (2026-08-04-npm-shai-hulud-keyv-supply-chain-attack)
-
2026-07-08: Ecosystem impact — typescript-7 native compiler cuts CI/editor type-check times for TS monorepos used by coding-agents (2026-07-08-typescript-7-microsoft-blog)
-
2026-07-30: stacked-pull-requests enter public preview for all repositories;
gh-stackCLI + agent skill; merge-queue support rolling out (2026-08-02-github-changelog-stacked-pull-requests, 2026-08-02-github-stacked-pull-requests-public-preview) -
2026-07-22: Restructures HackerOne bug-bounty — lower static public payouts, permanent vip-bug-bounty, signal gate; effective July 27 (2026-07-23-github-bug-bounty-restructure-vip)
-
2026-07-20: github-code-quality generally available on Enterprise Cloud/Team ($10/active committer + usage) (github-code-quality-ga)
-
2026-07-07: gitlost — Noma Security discloses critical indirect prompt-injection in Agentic Workflows enabling private-repo exfiltration via crafted public issues; no CVE/advisory published as of disclosure (2026-07-07-github-gitlost-agentic-workflows-vulnerability)
-
2026-06-11: Agentic Workflows entered public preview — natural-language markdown compiles to Actions YAML; coding agents (Copilot CLI, Claude Code, Codex) run in sandboxed ci-cd pipelines with Agent Workflow Firewall (2026-06-11-github-agentic-workflows-public-preview)
-
2026-06-11: Agentic workflows no longer require PATs —
GITHUB_TOKEN+copilot-requests: writepermission (2026-06-11-github-agentic-workflows-github-token) -
2026-06-03: Active unpatched zero-day in visual-studio-code/github.dev enables one-click OAuth token theft (2026-06-03-vscode-github-token-zero-day)
-
2026-06-02: github-copilot switched to token-based AI Credits billing; launched $100 Max plan (github-ai-credits)
-
2026-04-24: Policy change — github-copilot Free/Pro/Pro+ user interactions (prompts, outputs, code snippets) will train AI models by default (opt-out required).
-
2026-03-25: Announced privacy statement updates enabling data-driven training.
-
Copilot Business/Enterprise: Exempt from training data collection (enterprise tier protection).
-
Student/Teacher plans: Also exempt from new policy.
Developer Rights Controversy
The opt-out (vs. opt-in) default sparked debate about:
- Developer consent mechanisms
- Code ownership and derivative works
- Training data transparency
Represents shift from previous GitHub Copilot privacy stance.
Market Dominance
Despite cursor competition and training policy backlash, Copilot maintains market leadership through:
- GitHub integration (100M+ developers)
- IDE ecosystem (VS Code, JetBrains, etc.)
- Enterprise adoption