[AI Tool Updates] GitHub Copilot Adds Models and Policy Checks (9.26)

GitHub Copilot’s latest releases give eligible users more model choices and add tools for checking enterprise policies, measuring pull request review time and…

Table of contents

1. Overview
2. Details
3. Morning Breaking Updates
4. At a glance
5. FAQ
6. Sources

GitHub Copilot Adds Models and Policy Checks (9.26)

Overview

• GitHub Copilot added four named models across paid plans, with Claude Opus 5.5 and GPT-6 Sol limited to Pro+, Max, Business and Enterprise.
• A new enterprise settings validator identifies policy configuration errors down to the affected file and JSON path.
• Copilot’s repository-level usage reports now show median and 90th-percentile times for three stages of pull request review.
• Agentic autofix now reads and saves Copilot Memory for customers who have enabled the feature.
• Copilot in Slack and Microsoft Teams can use more shared conversation material when creating GitHub work.

Details

GitHub Copilot Adds Four Models Across Paid Plans

GitHub’s weekly Copilot release notes list Claude Opus 5.5, GPT-6 Sol, GPT-6 Luna and Grok 4.7 among the new model options. Access differs by plan. Claude Opus 5.5 and GPT-6 Sol are available to Pro+, Max, Business and Enterprise customers. GPT-6 Luna and Grok 4.7 are also available on Copilot Pro.

The same roundup mentions local sandboxing in the Copilot app and updates across Slack, Microsoft Teams, JetBrains and VS Code. Its supplied description does not specify a Copilot app version or give enough detail to describe how the sandbox works. The immediate, documented change for an individual user is therefore the model selection available under their subscription.

For teams, the plan distinction matters before a model becomes part of a shared workflow. A colleague on Pro may see GPT-6 Luna while another model used by a Pro+ colleague remains unavailable to them. The release notes establish availability by plan; they do not provide a basis for comparing model performance or calculating a new bill.

▸ Copilot model access deep dive

The four additions widen the choices inside an existing tool rather than replacing a single default model for every customer. That makes plan eligibility a practical deployment detail. Teams documenting prompts or reviewing an agent’s output should record which model produced the result, especially when collaborators use different plans. Otherwise, a repeat attempt may start with a different model and make the comparison less useful.

The split is also relevant to administrators preparing guidance for an organization. Business and Enterprise appear in the eligibility lists for all four named models. Pro appears only in the supplied lists for GPT-6 Luna and Grok 4.7. Those facts describe access, not a recommendation to standardize on any one model. The source excerpt contains no task benchmarks, usage allowances or price changes that would support that decision.

The local sandboxing mention points to a separate workflow question: where Copilot can run work and what boundaries apply. The roundup identifies its arrival but supplies no configuration steps here. Treating that mention as proof of particular isolation guarantees would go beyond the release note provided. For this briefing, the usable distinction is narrower: model access is stated by plan, while the sandbox’s operating details are not.

Teams can start with a small set of their own coding tasks when assessing the expanded menu. They can compare output quality, review effort and repeatability under the plans they actually hold. That approach follows from the access change without assuming that a newer model is automatically better for every repository.

Key takeaway: Copilot users have more model choices, but the available list depends on their plan. Teams should identify the model used when they compare results across colleagues.

Enterprise Validator Pinpoints Copilot Policy Errors

GitHub has added an in-product validator for enterprise managed settings in GitHub Copilot. It detects malformed JSON, unsupported configurations and invalid team mappings. These are errors that can prevent a policy from being enforced as intended.

Administrators can find the results in “Copilot settings validation” on the enterprise AI controls page. Each reported issue identifies the affected file and JSON path. That gives the person maintaining the settings a specific location to correct, rather than leaving them to search an entire configuration file.

The change is most relevant to organizations that manage Copilot policy through configuration files. A policy written in a file is useful only if the application accepts it and applies it to the intended people. The validator addresses that gap by making configuration failures visible inside the product. GitHub’s supplied announcement does not describe a new pricing tier or a change to the policy format.

▸ Enterprise policy validation deep dive

Enterprise settings often combine structured configuration with mappings to teams. An error in either part can change the practical reach of a rule. Malformed JSON may keep a setting from being parsed; an invalid team mapping may leave the intended group outside the policy’s scope. GitHub names both error types, along with unsupported configurations, in its announcement.

The file and JSON path attached to each issue matter because they turn a broad warning into a repair task. An administrator can identify the exact setting, correct it and review the validator again. That is particularly useful when several people maintain configuration or when a single file contains many controls. The announcement supports that workflow, though it does not say that validation replaces every other policy check an organization may perform.

This release also changes what a team can establish before relying on a managed setting. Previously, an apparently complete configuration could still contain an error that prevented enforcement. The new display offers direct feedback about known configuration problems. The implication is operational: policy owners can address detected failures while preparing a rollout, instead of discovering them after users report unexpected access.

The source does not announce a version number, a migration deadline or a new schema. Those details should not be inferred from the presence of a validator. The concrete step is to use the enterprise AI controls page to resolve the issues it identifies, then assess whether the intended policy reaches the right teams.

Key takeaway: The validator makes certain Copilot policy failures visible at the setting that caused them. Its value lies in helping administrators correct configurations before depending on them.

Copilot Reports Add Three Pull Request Review Stages

GitHub’s usage metrics update adds review timing to enterprise and organization repository-level Copilot reports. Each repos-1-day row can include a pull_request_review_times array. It reports a median and a 90th percentile for three intervals: ready for review to first review, first review to final review, and final review to merge.

The array also includes authored_by and reviewed_by, describing who opened and reviewed the pull requests in an entry. GitHub says both values are human in this release. That qualification is important when interpreting the report: these fields do not yet separate a human reviewer from an agent reviewer.

For engineering managers, the extra stages offer a more precise view than one end-to-end review duration. A long wait for the first review calls for a different investigation from a long gap between final review and merge. The release describes an added report field, with no breaking change identified in the supplied announcement.

▸ Pull request review metrics deep dive

The three intervals divide a familiar bottleneck into distinct parts. Time before a first review can reflect reviewer availability or assignment practices. Time between first and final review can reflect discussion and revision cycles. Time after final review can reflect merge queues or other steps. These are possible interpretations of the measurements, not causes established by the report itself.

Showing both the median and 90th percentile helps prevent one number from obscuring the distribution. The median describes a typical observation in the reported group. The 90th percentile draws attention to slower cases that a typical value may hide. A team can use the two together to decide whether delays affect most pull requests or a smaller group of unusually slow ones.

The unit of reporting also matters. GitHub describes repository-level rows for a day, so comparisons should account for the repository and period being measured. A change in the mix of pull requests could move a timing statistic even if the review process stayed the same. The figures are better treated as prompts for investigation than as a direct score for individual contributors.

Because authored_by and reviewed_by are human in this release, a reader should avoid using those fields to claim that an AI agent completed a review stage. The announcement adds visibility into review timing within Copilot usage reports. It does not establish that Copilot caused a faster or slower review. That distinction will matter when teams evaluate whether tool use changed their development process.

Key takeaway: The new report separates waiting for review, working through review and waiting for merge. Those measurements can locate delays, but they do not explain their cause on their own.

Agentic Autofix Begins Reusing Copilot Memory

GitHub said agentic autofix now uses Copilot Memory for customers who have enabled it. When addressing a security alert, autofix reviews existing memories for relevant context. After creating a fix, it stores the fix pattern as a memory for future use.

Those memories can help with later security alerts. GitHub also says they can inform other Copilot features, including code review and the cloud agent, about secure development patterns specific to a repository. The announcement describes behavior for customers with Memory enabled; it does not say that every Copilot customer receives the same memory-backed workflow automatically.

The practical change is continuity between fixes. A security repair can leave behind a pattern that another Copilot feature may use when it encounters related code. Developers still need to review each proposed change against the current alert and repository state. A previously useful pattern cannot, by itself, establish that a new fix is correct.

▸ Copilot Memory and autofix deep dive

Security alerts often recur in similar forms across a codebase. Reusing context from an earlier repair could help an automated fix follow conventions that are specific to that repository. GitHub’s description is limited to that mechanism: autofix reads memories and writes a pattern after creating a fix. It provides no measured improvement in resolution rate or review time in the supplied material.

The repository-specific aspect is the reason the change may be useful. A general suggestion can miss a project’s preferred libraries, surrounding code or established secure pattern. A stored fix pattern gives later work additional local context. It can also carry the assumptions of the earlier fix, so reviewers should consider whether those assumptions still hold for a different alert.

The link to code review and the cloud agent broadens the possible effect beyond autofix. GitHub says the memories can teach those features about patterns unique to the repository. That does not mean every stored pattern will be used in every subsequent task, or that it replaces a human security review. The announcement does not specify selection rules for memories in the evidence provided here.

For a team already using both features, the useful question is whether later suggestions reflect the project’s actual secure coding practices. Reviewing a few related alerts and their proposed fixes would test that implication directly. For a customer without Copilot Memory enabled, the stated condition is decisive: this announcement does not establish the same behavior for their account.

Key takeaway: Memory gives agentic autofix a way to carry a repository’s prior repair patterns into later work. The change applies when the customer has enabled Copilot Memory.

Copilot Uses More Slack and Teams Context for GitHub Work

GitHub’s Slack and Microsoft Teams update expands the material Copilot can use from a conversation. GitHub specifically mentions shared files in Slack, along with images and forwarded messages in Teams. It also reports changes to how Copilot creates GitHub work and connects that work to the source discussion.

That matters when a request begins in a chat thread rather than an issue. A shared artifact or forwarded message may contain the context needed to describe the work accurately. Carrying a connection back to the discussion can help teammates understand where the request came from after it moves into GitHub.

The supplied announcement does not specify new plan requirements, an app version or a list of supported file formats. It establishes the added categories of context and the improved connection to GitHub work. Teams should judge the resulting issue or task by whether it preserves the relevant decisions from the conversation.

▸ Copilot chat integrations deep dive

Moving work from chat to a repository often loses detail. A request may depend on a file shared earlier in a Slack thread or an image posted in Teams. GitHub’s update addresses that handoff by allowing Copilot to use more of the material already present in those conversations. Its value depends on the created GitHub work accurately reflecting that material.

The change also raises a practical review question. A conversation may contain several ideas, while only one has become an agreed task. More available context gives Copilot more material to consider; it does not decide which statements represent the final requirement. The person creating or accepting the GitHub work still needs to check its scope and wording.

Connecting the new work to the source discussion helps with traceability. A teammate arriving later can follow the decision back to its conversational context instead of relying only on a brief issue description. That can reduce ambiguity when the original request involved a visual example or a forwarded message. The supplied source does not quantify time saved or describe exactly how that connection appears in every client.

The Slack and Teams changes serve a different part of the workflow from the model and metrics releases. They affect the handoff into GitHub work. The review metrics describe what happens after pull requests are ready for review. Together, those updates cover separate stages, but the announcements provide no evidence that one caused an improvement in the other.

Key takeaway: Copilot can carry more conversation context into GitHub work from Slack and Teams. The created task still needs a check against the decision recorded in the discussion.

Morning Breaking Updates

• Nadeem Iqbal: Welcome to TechTok Technology! 🚀 | AI Tools, Computer Shortcuts & Tech Updates - Video Title Options Option 1 (Viral & Direct): Welcome to TechTok Technology! | AI Tools, Computer Shortcuts & Tech Updates ...
• Rai Tryna: AI tools I use as a 25 year old working in corporate, running... #Shorts #raitryna - AI tools I use as a 25 year old working in corporate, running... AI tools I use as a 25 year old working in corporate, running.

At a glance

Fact	Publisher	Source
Claude Opus 5.5 and GPT-6 Sol are available on Copilot Pro+, Max, Business and Enterprise.	github.blog	github.blog
GPT-6 Luna and Grok 4.7 are also available on Copilot Pro.	github.blog	github.blog
The enterprise settings validator flags malformed JSON and invalid team mappings.	github.blog	github.blog
Copilot usage reports add median and 90th-percentile pull request review times.	github.blog	github.blog
Agentic autofix uses Copilot Memory when customers have enabled it.	github.blog	github.blog
Agentic autofix stores a completed fix pattern as memory for future use.	github.blog	github.blog
Copilot can use more context from Slack files and Teams images and forwarded messages.	github.blog	github.blog

FAQ

Q1. Which new Copilot models can a Pro subscriber access?

A. GitHub’s weekly release notes list GPT-6 Luna and Grok 4.7 for Copilot Pro. The supplied eligibility lists place Claude Opus 5.5 and GPT-6 Sol on Pro+, Max, Business and Enterprise.

Q2. Why would an enterprise policy appear configured but fail to apply?

A. GitHub says malformed JSON, unsupported configurations and invalid team mappings can prevent intended enforcement. Its validator identifies the affected file and JSON path so an administrator can correct the reported error.

Q3. Do the new review metrics measure Copilot’s effect on pull request speed?

A. No causal measure is described in GitHub’s announcement. The report adds median and 90th-percentile timing for three review stages; it does not establish why those times changed or whether Copilot changed them.

Q4. How do Copilot Memory and the Slack or Teams updates differ?

A. GitHub describes Memory as context that agentic autofix can reuse when resolving security alerts. The Slack and Teams update concerns context carried from a conversation into GitHub work. They address different stages of a workflow.

Q5. What should teams watch after these releases?

A. Teams can check whether the validator clears intended policies, whether 90th-percentile review delays move, and whether memory-backed fixes fit current code. GitHub’s supplied announcements give no deadline or deprecation date for these checks.

Sources

1. Enterprise managed settings in-product validator - github.blog
2. Usage metrics API adds pull request review stages - github.blog
3. Private saved views for repository issues and “Relates to” issue relationship is generally available - github.blog
4. Proaction boosts sales 60% and saves 75+ hours with Codex - openai.com
5. Changes to query results in the GitHub Actions API and UI - github.blog
6. Agentic autofix now uses Copilot Memory - github.blog
7. GitHub Copilot weekly releases — September 21 - github.blog
8. Updates to GitHub Copilot for Slack and Microsoft Teams - github.blog
9. Google AI Blog - Google
10. Anthropic News - Anthropic
11. Welcome to TechTok Technology! 🚀 | AI Tools, Computer Shortcuts & Tech Updates - Nadeem Iqbal
12. AI tools I use as a 25 year old working in corporate, running... #Shorts #raitryna - Rai Tryna

Last updated: 2026-09-27T06:04:15.154Z