Copilot code review

Use Copilot code review to get automated, configurable review suggestions on pull requests and new pushes, and to standardize default review effort settings across an enterprise.

Availability

Generally available on paid Copilot plans

Pricing model

Paid Copilot plans

Deployment

GitHub Enterprise Cloud

Privacy

Users can view or delete saved preferences in Copilot settings

Licence

Requests can use a member's Copilot entitlement or be billed to the organization that owns the repository.

• Users can turn on automatic reviews that trigger when creating a pull request, coauthoring a pull request, or moving a pull request out of draft state. ^[1]

  Turn on automatic reviews from Copilot, which will trigger when you create a pull request, coauthor a pull request, or move a pull request out of draft state.

• Users can enable automatic reviews for new pushes and for draft pull requests they create or coauthor. ^[1]

  Turn on automatic review for new pushes and for draft pull requests you create or coauthor.

• A dedicated personal "code review" settings page is now available on every Copilot plan, including Copilot Business and Copilot Enterprise. ^[1]

  Under your profile → Copilot settings , a dedicated "code review" page under Copilot is now available on every Copilot plan, including Copilot Business and Copilot Enterprise.

• Users can set a default review effort (Lite or Balanced) that applies to requested and automatically configured reviews, with the option to choose a different effort when manually requesting a review. ^[1]
• Authorized enterprise administrators can set a single enterprise-wide default review effort that applies to organization-owned repositories through inheritance. ^[1]

  Authorized enterprise administrators can now set one default review effort (i.e., Lite , Balanced , or the GitHub default) for the whole enterprise.

• Preview features remain opt-in. ^[2]

  Preview features remain opt-in.

• The policy applies to eligible features managed on the enterprise Features & clients page, Copilot Code Review policy, and MCP servers in Copilot policy. ^[2]

  This policy applies to eligible features managed on your enterprise's "Features & clients" page (i.e., https://github.com/enterprises/YOUR-ENTERPRISE-SLUG/ai-controls/copilot/features), as well as the Copilot Code Review policy on the "Agents" page and the MCP servers in Copilot policy.

• Administrators can configure the policy for 28 days before it affects feature access for users. ^[2]

  For the next 28 days, you can configure this policy, but it won't affect feature access for your users yet.

• Starting October 22, eligible generally available features left Unconfigured follow the selected global default. ^[2]

  Eligible generally available features and capabilities left Unconfigured will follow your selected global default of enabled, disabled, or let organizations decide.

• Explicitly enabled or disabled feature decisions are preserved. ^[2]

  If you've explicitly enabled or disabled a feature, we won't override that choice.

• Administrators can review errors in the “Copilot settings validation” section of the enterprise AI controls page. ^[3]

  Review and correct errors in the "Copilot settings validation" section of the enterprise AI controls page.

• Each issue identifies the affected file and JSON path. ^[3]

  Each issue identifies the affected file and JSON path, helping you make corrections to ensure that policies are enforced as intended.

• Validation covers copilot/managed-settings.json and copilot/team-mappings.json, including team settings files referenced by the mappings file. ^[3]

  copilot/team-mappings.json and any team settings files referenced by the team mappings file

• The validator detects malformed JSON, unsupported configurations, invalid team mappings, and other errors that can prevent policies from being enforced. ^[3]

  The validator detects malformed JSON, unsupported configurations, invalid team mappings, and other errors that can prevent policies from being enforced.

• Copilot Business and Enterprise administrators must enable preview features. ^[4]

  For Copilot Business and Enterprise, an administrator must enable preview features.

• HydraFusion is available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI. ^[4]

  The HydraFusion research preview is now available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI.

• HydraFusion orchestrates multiple models rather than being a single model. ^[4]

  HydraFusion appears in the model picker, but rather than being a single model, it orchestrates multiple models.

• HydraFusion uses one of three workflows: Single, Cascade, or Critique. ^[4]

  HydraFusion uses one of three workflows:

• HydraFusion is available to Copilot Pro, Pro+, Business, and Enterprise users. ^[4]

  HydraFusion is available to Copilot Pro, Pro+, Business, and Enterprise users.

• HydraFusion remains a research preview and is subject to change. ^[4]

  HydraFusion remains a research preview and is subject to change.

• Balanced is the default effort level for new and existing repositories and organizations using Copilot code review, unless Lite was explicitly selected. ^[5]

  As announced on August 28, 2026, the Default review effort level now uses Balanced for new and existing repositories and organizations using Copilot code review.

• A request can optionally set the review effort level. ^{[1] [5]}

  When you make a request, you can optionally set the review effort level for that review.

• The changes are generally available to Copilot Pro, Pro+, Max, Business, and Enterprise plans. ^{[1] [5]}

  These changes are generally available to Copilot Pro, Pro+, Max, Business, and Enterprise plans.

• Copilot code reviews can be requested through supported REST and GraphQL APIs. ^[5]

  You can now request a GitHub Copilot code review through the REST and GraphQL APIs and set the review effort level for each request.

• HydraFusion is a research preview in VS Code and the GitHub Copilot app alongside Copilot CLI. ^[6]

  Let Copilot select and coordinate models for your task with HydraFusion , a research preview now available in VS Code and the GitHub Copilot app alongside Copilot CLI.

• The announcement says HydraFusion provides clearer, more frequent progress updates. ^[6]

  Clearer, more frequent progress updates help you follow its work.

• HydraFusion lets Copilot select and coordinate models for a task. ^[6]

  Let Copilot select and coordinate models for your task with HydraFusion , a research preview now available in VS Code and the GitHub Copilot app alongside Copilot CLI.

• Local sandboxing is generally available in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. ^[7]

  Local sandboxing for GitHub Copilot is now generally available in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.

• Sandbox policies can limit the files and directories that agent-run commands can read or modify. ^[7]

  Limit the files and directories that agent-run commands can read or modify.

• Developers can control access to the internet, local networks, Git credentials, and GitHub CLI credentials. ^[7]

  Control access to the internet, local networks, Git credentials, and GitHub CLI credentials.

• Microsoft eXecution Container translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux. ^[7]

  Local sandboxing is powered by Microsoft eXecution Container (MXC) , which translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux.

• Local sandboxing is included with GitHub Copilot at no additional cost. ^[7]

  Local sandboxing is included with GitHub Copilot at no additional cost.

• The new checks will be off by default, and running /security-review will not enable them. ^[8]

  The new opt-in checks for push protection and the security review command will consume GitHub AI Credits.

• GitHub is adding checks from the secret classifier alongside the existing LLM-based security review. ^[8]

  Coming soon, GitHub is adding checks from the secret classifier alongside the existing LLM-based review.

• The new checks are coming soon in private preview. ^[8]

  AI-based secret scanning with the GitHub Copilot /security-review command for the Copilot CLI and Copilot app available soon in private preview.

• The new checks will consume AI Credits in addition to the review’s existing usage. ^[8]

  The new checks will consume AI Credits in addition to the review's existing usage.

• No GHSP or GHAS license is required to use these checks. ^[8]

  You don't need a GHSP or GHAS license to use these checks.

• When the authorized-users setting is enabled at the organization level, repository admins cannot turn it off. ^[9]

  If you turn it on at the organization level, repository admins can't turn it off.

• The billing setting is available in organization settings under Copilot -> Policies. ^[9]

  You can find the setting in your organization settings, under Copilot -> Policies .

• Organization owners and repository admins can control whether people with external Copilot licenses can request a review. ^[9]

  Review request controls: Organization owners and repository admins can control whether people with external licenses can request a review.

• Organization billing requires AI Credits paid usage to be enabled. ^[9]

  This requires AI Credits paid usage to be enabled for the organization, and you can optionally set a budget.

• Organization owners can bill eligible code reviews to the organization's cost center instead of using members' Copilot quotas. ^[9]

  Billing: Organization owners can bill Copilot code reviews from members with a Copilot license to the organization's cost center instead of using up those members' Copilot quotas.

• Local sandboxing is included with Copilot at no extra cost. ^[10]

  This is included with Copilot at no extra cost.

• Local sandboxing can limit agents’ access to files, networks, and credentials. ^[10]

  Limit agents' access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host.

• Local sandboxing is available in the Copilot app and VS Code sessions using Agent Host. ^[10]

  Limit agents' access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host.

• Local sandboxing is generally available in Copilot CLI. ^[10]

  Limit agents' access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host.

• Administrators can independently control capture of prompts, responses, toolArguments, toolOutput, and policyDetail. ^[11]

  Administrators can also independently control five additional capture classes:

• The telemetry.capture.identity setting adds user.name, process.user.name, and host.name attributes to OpenTelemetry data. ^[11]

  The telemetry.capture.identity setting adds three attributes to OpenTelemetry (OTel) data:

• Identity capture is off by default and remains separate from the existing pseudonymous user identifier. ^[11]

  Identity capture is off by default and remains separate from the existing pseudonymous user identifier.

• Every capture class is off by default. ^[11]

  Every capture class is off by default.

• Explicit managed values take precedence over local settings, SDK configuration, and environment variables. ^[11]

  Explicit managed values take precedence over local settings, SDK configuration, and environment variables.

• Fine-grained capture controls are available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. ^[11]

  Fine-grained capture controls are available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.

• The setting is supported in Copilot CLI, VS Code, and the GitHub Copilot app. ^[12]

  The setting is supported in Copilot CLI, VS Code, and the GitHub Copilot app.

• With the setting active, a cached response cannot satisfy the freshness requirement. ^[12]

  While the setting is active, a cached response cannot satisfy the freshness requirement.

• If a client cannot confirm current policy, it fails closed rather than running with stale or unconfirmed policy. ^[12]

  If the client cannot confirm current policy, it fails closed rather than running with a stale or unconfirmed policy.

• The forceRemoteSettingsRefresh setting can require supported clients to retrieve current settings at startup. ^[12]

  Enterprise administrators can now require supported GitHub Copilot clients to retrieve current server-managed settings at startup instead of relying on a cached policy.

• The sandbox key can enforce a required minimum client version, forcing users on older versions to update to resume using Copilot. ^[12]

  When this key is included in managed settings, users who pin to older versions of Copilot clients will now be forced to update in order to resume using Copilot.

• Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra are scheduled for deprecation across GitHub Copilot experiences on November 16, 2026. ^[13]
• Claude Opus 4.8 remains available to individual GitHub Copilot subscribers on annual plans. ^[13]

  *Claude Opus 4.8 will remain available to individual GitHub Copilot subscribers on annual plans so they retain an Opus offering.

• Claude Opus 5.5 is the suggested alternative to Claude Opus 4.8 and Claude Opus 5. ^[13]

  The deprecation of Claude Opus 4.8 does not apply to these customers.

• GPT-6.1 Sol or GPT-6 Luna are suggested alternatives to GPT-5.6 Terra. ^[13]

  GPT-6.1 Sol or GPT-6 Luna

• Suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business customers under default model enablement, unless an administrator has disabled them. ^[13]

  Under default model enablement, the suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business customers unless an administrator has turned off the global default or explicitly disabled the model.

• GET and PATCH endpoints for model policies are generally available. ^[14]

  GET and PATCH endpoints are now generally available for model policies at four levels:

• The API supports model policies at the enterprise level. ^[14]

  You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations.

• The API supports model policies for enterprise teams and enterprise apps. ^[14]

  You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations.

• The API supports model policies at the organization level. ^[14]

  You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations.

• Enterprise policies can delegate model control to organizations in organization mode, or to teams and apps in enterprise teams mode. ^[14]

  Enterprise policies can delegate model control to organizations in organization mode, or to teams and apps in enterprise teams mode.

• Preview features remain opt-in. ^[15]

  Preview features remain opt-in.

• Eligible generally available features left Unconfigured are set according to the selected global default. ^[15]

  Eligible generally available features and capabilities left Unconfigured will be set according to the selected global default of Enabled , Disabled , or Let organizations decide .

• Administrators can choose Enabled, Disabled, or Let organizations decide as the global default. ^[15]

  Eligible generally available features and capabilities left Unconfigured will be set according to the selected global default of Enabled , Disabled , or Let organizations decide .

• Explicit choices for individual features are preserved during rollout. ^[15]

  Administrators can still make explicit choices for individual features at any time.

• Enforcement is gradually rolling out through October 26. ^[15]

  Starting today, we're gradually rolling out enforcement of the policy through October 26, so it may take effect at different times for different enterprises and organizations.

• Usage is attributed and billed to the organization that owns the installation. ^[16]

  Usage is attributed and billed to the organization that owns the installation.

• Server-to-server authentication is available in public preview. ^[16]

  GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview.

• Services and agents built with the GitHub Copilot SDK can make requests on behalf of an organization without a signed-in user's credentials. ^[16]

  Services and agents built with the GitHub Copilot SDK can now make requests on behalf of an organization without relying on a signed-in user's credentials.

• A GitHub App can be given the read-only Copilot Requests organization permission and installed on an organization. ^[16]

  Developers can give a GitHub App the read-only Copilot Requests organization permission, install the app on an organization, and pass a short-lived installation access token to the Copilot SDK.

• Organization owners can review app access, identify app-attributed usage in AI usage CSV reports, and suspend or uninstall an app to stop its access. ^[16]

  Organization owners can review which apps have access, identify app-attributed usage in AI usage CSV reports using the app_client_id field, and stop an app's access by suspending or uninstalling it.

• A large language model evaluates requests to run commands, access a file system path, or open a URL. ^[17]

  When Copilot requests permission to run a command, access a file system path, or open a URL, a large language model evaluates the request.

• Requests classified as clearly safe automatically proceed. ^[17]

  Requests classified as clearly safe automatically proceed.

• Requests not classified as clearly safe require approval. ^[17]

  Requests classified as clearly safe automatically proceed.

• Enterprise administrators can block Allow All while keeping Assisted available, or disable Assisted separately. ^[17]

  If you're an enterprise administrator, you can use enterprise-managed settings to block Allow All while keeping Assisted available or disable Assisted separately.

• Assisted permissions are generally available in GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code. ^[17]

  Assisted permissions are now generally available in GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code.

• Administrators can choose the default permission mode for new sessions. ^[17]

  You can also choose the default permission mode for new sessions.

• Copilot Chat, Copilot code review, and Copilot in the cloud require available budget. ^[18]

  Copilot Chat, Copilot code review, and Copilot in the cloud require available budget to use.

• Available now for GitHub Enterprise Cloud customers working with a GitHub or Microsoft account team. ^[18]

  Enterprises working with a GitHub or Microsoft account team can now get Copilot included with GitHub Enterprise for every licensed user.

• Self-serve availability is opening in stages, and current self-serve subscriptions are unaffected. ^[18]

  Self-serve availability is coming in stages, and current self-serve subscriptions are unaffected.

• AI usage is metered from the first request against the enterprise budget. ^[18]

  AI usage is metered from the first request against your enterprise budget, using the policies, alerts, and attribution you already have.

• Code completion and next edit suggestions keep working even when no budget is available. ^[18]

  Code completion and next edit suggestions keep working even with no budget available.

• Copilot access through GitHub Enterprise has the same features and models as Copilot Enterprise but does not include monthly AI credits per seat. ^[18]

  Copilot access through GitHub Enterprise and Copilot Standalone has the same features and models as Copilot Enterprise but does not include monthly AI credits per seat.

• Organization and enterprise owners can disable image generation using Copilot model policies. ^[19]

  Organization and enterprise owners can turn off image generation by disabling the image generation model using Copilot model policies .

• Generated images are previewed inline and saved to the project. ^[19]

  When you ask for an image, your selected reasoning model calls a dedicated image-generation tool powered by GPT Image 2.5 Flare, previews the result inline, and saves it to your project.

• Image generation is in public preview for Copilot Pro, Copilot Pro+, Copilot Business, and Copilot Enterprise. ^[19]

  Image generation is in public preview for Copilot Pro, Copilot Pro+, Copilot Business, and Copilot Enterprise.

• Image generation is billed separately from the chat model based on image tokens that count toward the plan’s AI credits. ^[19]

  It's billed separately from your chat model, based on image tokens that count toward your plan's AI credits.

• Copilot can generate and edit images using natural language. ^[19]

  You can now generate and edit images using natural language in GitHub Copilot.

• The selected reasoning model calls a dedicated image-generation tool powered by GPT Image 2.5 Flare. ^[19]

  When you ask for an image, your selected reasoning model calls a dedicated image-generation tool powered by GPT Image 2.5 Flare, previews the result inline, and saves it to your project.

• Copilot can remember personal preferences and repository conventions across sessions and clients. ^[20]

  Copilot can remember personal preferences and repository conventions across sessions and clients.

• Users can view or delete saved preferences in Copilot settings. ^[20]

  You can interact with memories in the Copilot app, Copilot CLI, and VS Code, or manage personal memories in your Copilot settings, where you can view or delete saved preferences .

• GitHub Copilot Memory is generally available on paid Copilot plans. ^[20]

  GitHub Copilot Memory is now generally available on paid Copilot plans.

• AWS Continuum can investigate code vulnerabilities and propose fixes Daily brief 2026-10-25
• OpenGCUA for macOS leads 12 AI developments on 19 October 2026 Daily brief 2026-10-19
• Bespoke-Nimble-9B-v2 leads 12 AI developments on 15 October 2026 Daily brief 2026-10-15
• An open model for tool-using agents, plus a checkpoint to fine-tune Daily brief 2026-10-13
• Two local models can classify, route, or score text and images Daily brief 2026-10-10
• Turn documents, charts, audio, and video into structured information Daily brief 2026-10-09
• Liquid AI’s decision models classify inputs without writing a response Daily brief 2026-10-07
• Backburner leads 25 AI developments in week 40, 2026 Weekly brief 2026-W40
• Microsoft introduces FrogNano-4B-2609 for repository-level coding workflows Daily brief 2026-10-03
• GitHub expands Copilot controls and adds local sandboxing Daily brief 2026-09-30
• GitHub adds controls for Copilot code review and local sandboxing Daily brief 2026-09-26
• Meta previews Muse Video and releases Muse Image and Muse Spark Daily brief 2026-09-25