Rating certificate · AW/26-09/41926 Sept 2026
72of 100
The Register / Coding agents / GitHub Copilot
Register entry · Coding agents · updated 26 Sept 2026
GitHub Copilot
GitHub Copilot spans inline completions, agent mode in VS Code, Visual Studio and JetBrains, the Copilot CLI, a desktop Copilot app, and the Copilot cloud agent (formerly 'coding agent'), which takes an assigned issue, works in an ephemeral GitHub Actions environment and opens a pull request. It routes to models from OpenAI, Anthropic, Google, xAI and open-weight providers. Since 1 June 2026 all plans bill agent, chat and review usage in token-based GitHub AI Credits, while completions stay unlimited on paid plans.
What reviewers and users praise
- Broad model choice under one enterprise contract, including open-weight models, is cited as its enterprise advantage (HN, July 2026).
- Reach and distribution: 50 million users and deep GitHub integration (Microsoft FY26 Q4 call; GitHub discussion users citing GHE integration).
- Independent reviewers find it pays off for high-volume, well-tested code in mainstream languages (Netguru, Sept 2026).
What they criticise
- June 2026 move to usage-based AI Credits was widely read as a large effective price increase; many users said they would cancel (HN and GitHub Community, April 2026).
- Trust damage from Copilot inserting promotional 'tips' into pull requests in March 2026, later withdrawn.
- Individual-plan interaction data used for model training by default since 24 April 2026 unless users opt out.
- Real-world suggestion acceptance reported well below GitHub's published figures (Netguru, Sept 2026).
Experts vs the crowdcrowd cooler by 22
Experts65
Crowd43
| Price | Free, paid from $10 |
|---|---|
| Use it via | IDE extension, CLI, Desktop app, Web app, Mobile app, Chat apps, API |
| Runs on | macos, windows, linux, web |
| Licence | proprietary |
| Updated | Evidence collected 26 Sept 2026 |
How the rating was worked out
Weights for Coding agents: adoption 35%, experts 40%, crowd 25%. Pillars without enough evidence are left out and the others re-weighted. The method.
| Adoption & momentumweight 35% | 100 | VS Code / Open VSX installs 78M → 100 · Reported users 50M → 100 · 100 releases in 90 days → 100reach × 0.7 + momentum × 0.3 |
|---|---|---|
| Expertsindependent reviews · weight 40% | 65 | 7 independent reviews (3 positive · 4 mixed · 0 negative), averaged toward 50 for small samples. |
| Crowdcommunity sample · weight 25% | 43 | 21 dated posts from hackernews, github, reddit: 5 positive · 7 mixed · 9 negative (positive + ½ mixed) ÷ n, averaged toward 50 for small samples |
| Rating | 72 | high confidence (3 of 3 pillars, 21 community posts). |
Evidence checks. 1 post over the three-per-thread limit not counted. How evidence is checked.
Editorial adjustment. Not independent: the author sells a competing AI workspace product (gapfill-1). Also: the @github/copilot npm package is the Copilot CLI and counts only on the github-copilot-cli entry, so it is not counted twice.
Trust & safety
Seven dimensions graded A–D from documented facts. Overall: B.
B
Permission model
Cloud agent runs in its own ephemeral GitHub Actions environment and can open one pull request per task on one branch. IDE agent mode asks for approval on tool calls; assisted approvals (auto-approve low-risk calls) and local sandboxing limiting file/network/credential access were only in public preview as of 2026-09-25, so local agent sessions are not sandboxed by default. source
A
Data access scope
Cloud agent works per repository, on one branch at a time, one pull request per task; local sandboxing (preview) limits file, network and credential access; organization policies gate enablement for Business/Enterprise. source
n/e
Data storage
Cloud service hosted by GitHub; data-residency and deletion controls were not read for this profile.
C
Data retention & training
From 2026-04-24, interaction data (inputs, outputs, code snippets, context) from Copilot Free, Pro and Pro+ is used to train GitHub's models unless the user opts out; Business and Enterprise plans are excluded. source
n/e
Incident history (24 months)
Repeated serious issues in 24 months: CVE-2025-53773 (CVSS 9.6, prompt injection enabling code execution without approval, Aug 2025), the 'Comment and Control' prompt-injection secret exfiltration affecting the Copilot coding agent (CVSS 9.4, disclosed April 2026), and CVE-2026-45033 (Copilot CLI command execution via nested bare git repo). Details come from search results and secondary coverage; resolution status of each was not verified page by page. Separately, Copilot inserted promotional text into ~1.5M pull requests (March 2026), withdrawn after backlash. Regraded from D: Revision 2: D needs an unresolved issue or a slow or undisclosed fix, and C needs each issue fixed and disclosed; the evidence establishes neither, so this dimension is not graded. source
A
Compliance
Copilot Business and Enterprise are covered by GitHub's SOC 2 Type II report (period to 2024-09-30) and are in scope of GitHub's ISO 27001 certificate; reports available via the GitHub Enterprise Trust Center. source
B
Transparency
Closed-source service (github/copilot-cli repo holds only installer, changelog and licence; the MIT-licensed vscode-copilot-chat repo was archived in 2026). Detailed weekly public changelog and extensive docs. source
The experts
7 named independent reviews found; dated reviews from the last 12 months are scored.
- mixed
GitHub Copilot pays off when your team writes high-volume, well-tested code in mainstream languages
Kacper Rafalski (Netguru) · 23 Sept 2026 · netguru.com - mixed
Copilot is not trying to become Cursor. It is trying to make GitHub itself agentic.
Developers Digest · 2 May 2026 · developersdigest.tech - positive
Copilot, by contrast, lets me build more freely without feeling like every iteration is a meter running.
Reyanna Pitts (founder, B.P. Solutions) · 23 Jan 2026 · linkedin.com - positive
running Copilot CLI as a scriptable review step inside pre-commit hooks stops being a risk and starts being a routine.
Jakub Jirák (Think Different blog) · 27 Jan 2026 · thinkdifferent.blog - mixed
Nine months ago, 46% of respondents said they used GitHub Copilot. Since then, it’s barely risen.
Gergely Orosz and Elin Nilsson (The Pragmatic Engineer) · 3 Mar 2026 · newsletter.pragmaticengineer.com - positive
I have been using the GitHub Copilot app for a few days, and my first impression is simple: this feels like a real workflow shift.
Logan Farci · 10 Jun 2026 · loganfarci.com - mixed
The paywall is the first hurdle. GitHub Copilot CLI demands an active Copilot subscription before you can even test it
Murat Akdeniz (Codexpedite) · 6 Jul 2026 · codexpedite.com
The crowd
21 coded posts from hackernews, github, reddit.
5 positive7 mixed9 negative
- negative
With this kind of pricing (sonnet 4.6 has 9x multiplier, previously 1x) it begs the question why use Copilot to begin with.
GitHub Copilot is moving to usage-based billing · 27 Apr 2026 · news.ycombinator.com - mixed
I pay for Copilot annually, and mostly for its code auto completion features. I use CC if I want to do anything agentic.
GitHub Copilot is moving to usage-based billing · 27 Apr 2026 · news.ycombinator.com - negative
So I guess from now on GH Copilot is only worth it if you want a quality autocomplete in VSCode.
GitHub Copilot is moving to usage-based billing · 27 Apr 2026 · news.ycombinator.com - negative
Microsoft will probably try to sneak it back in later. They've done that with other intrusions. Migrating away from Github just increased in priority.
GitHub backs down, kills Copilot pull-request ads after backlash · 31 Mar 2026 · news.ycombinator.com - positive
People have been asking for a way to run the Chinese models from a trusted provider. Here GitHub delivered!
Kimi K2.7 Code is generally available in GitHub Copilot · 2 Jul 2026 · news.ycombinator.com - positive
They have a pretty good agent CLI and SDK, and now a desktop app. They have hosted agents
Kimi K2.7 Code is generally available in GitHub Copilot · 2 Jul 2026 · news.ycombinator.com - mixed
Copilot was OK for my purposes, and the USD 10 per month fee was enough for my usage.
Kimi K2.7 Code is generally available in GitHub Copilot · 2 Jul 2026 · news.ycombinator.com - negative
Can I request a refund for the remainder of my annual plan? I've stopped using Microsoft GitHub Copilot altogether.
github.com/community discussion #192948: GitHub Copilot is moving to usage-based billing · 27 Apr 2026 · github.com
Pricing
As published, checked 26 Sept 2026.
| Plan | Price | Notes |
|---|---|---|
| Free | Free | 2,000 completions/month, 50 chat requests, limited agent use; CLI and agent mode included. |
| Pro | $10 / monthly | Includes AI Credits allowance; cloud agent and code review. |
| Pro+ | $39 / monthly | Larger AI Credits allowance; third-party coding agents (Claude, OpenAI). |
| Max | $100 / monthly | Largest individual AI Credits allowance, for sustained agent workflows. |
| Business | $19 / monthly per user | Plans page shows 'contact sales'; $19/user/month and bundled credits per the GitHub Community billing FAQ and third-party coverage. |
| Enterprise | $39 / monthly per user | Plans page shows 'contact sales'; $39/user/month per the GitHub Community billing FAQ and third-party coverage. Adds codebase indexing and github.com customization. |
Recent changes
- 25 Sept 2026
Weekly release: Claude Opus 5.5, GPT-6 Sol/Luna and Grok 4.7 added; local sandboxing for agents (public preview); assisted approvals in JetBrains (preview); agents in Dev Containers over SSH/Tunnel/WSL. source
- 10 Sept 2026
Jira integration in the Copilot app; experimental adaptive model routing (Project HydraFusion) in Copilot CLI. source
- 1 Jun 2026
All plans moved to usage-based billing in GitHub AI Credits; completions remain unlimited on paid plans. source
- 24 Apr 2026
Interaction data from Free/Pro/Pro+ used for model training by default, with opt-out. source
Ranked alongside
Other ranked entries in Coding agents.
OpenCodeAnomaly75
Claude CodeAnthropic73
Zed (Agent Panel)Zed Industries73
Codex (CLI and app)OpenAI71
Grok BuildSpaceXAI (formerly xAI)68
Sources
Every figure above traces to one of these, observed up to 26 Sept 2026.
- CNBC (May 2026) states Copilot 'has surpassed 26 million users' (older figure than the 50M earnings-call number)
- HN: GitHub Copilot is moving to usage-based billing (767 points)
- HN: Copilot edited an ad into my PR (1,606 points)
- HN / Wiz: AI-generated Copilot Autofix introduced a workflow injection that let Wiz reach Snowflake's Jira (2026-08-17); root cause was a customer-merged Actions change
- CVE-2026-45033 Copilot CLI (seen in search results only)