New in September 2026: Grok 4.7 lands in the model picker

GitHub added Grok 4.7 to Copilot on September 21, the day xAI shipped it. It’s xAI’s strongest coding model so far — CursorBench 4.0 went from 40.4% to 46.3% over Grok 4.6, DeepSWE v1.1 from 65.2% to 71.0%, on xAI’s own evals — and the API price didn’t move, holding at $2 per million input tokens and $6 per million output.

For most Copilot users this is a picker entry, not a change in your day. It’s worth noting mainly because it lands in the same 48 hours as Claude Opus 5.5 and GPT-6 Sol, all three of them competing in the tier below the flagships. The Copilot seat price is unaffected. Context in three frontier models in 48 hours.

GitHub Copilot was the first AI coding assistant to reach mainstream adoption, and its influence on everything that came after (Cursor, Windsurf, Codeium) is hard to overstate. When it launched in 2021, the idea of AI generating whole functions from a comment felt like a party trick. Now it’s a baseline expectation. Copilot normalized the category.

In 2026, it remains the most widely used AI coding assistant. That’s partly momentum, partly distribution (Microsoft owns both GitHub and VS Code), and partly because it’s genuinely good at what it does. The free tier, which arrived in late 2024, brought in a new wave of users.

September 17, 2026: Copilot is the one that didn’t get patched

Air Security’s Plugin4Shell disclosure, reported by The Register, found a zero-click remote code execution flaw in how all four major coding agents enforce plugin SHA pinning. Anthropic and OpenAI shipped fixes. Microsoft has not, and Air says it never received a response to a disclosure sent in June.

GitHub’s position, given to The Register, is that the attack doesn’t work on GitHub because GitHub refuses to create branch names that look like 40-character commit hashes. That’s accurate as far as it goes. Air’s counter is that Copilot supports marketplaces hosted on Bitbucket and self-hosted git servers, which allow those names — so the host-side mitigation protects GitHub, not Copilot.

Practical read: if every plugin you use comes from a GitHub-hosted marketplace, you’re covered for now by GitHub’s branch-name restriction. If any of them come from anywhere else, or you don’t know, there is no patch. This is the first entry on this page where the recommendation is to stop doing something rather than to budget for something. Full breakdown in the fix for last month’s agent supply chain problem doesn’t work.

New in September 2026: three more dated changes, none of them a price

The credit cliff below landed on schedule today. In the same 72 hours GitHub published four more changes, and three of them have dates on them. None touches the seat price.

October 1, 2026 — pay before you use. GitHub is reopening Copilot Business and Enterprise signups for credit card and PayPal customers, with stricter account vetting attached. New seat assignments require payment for each seat before the user gets access, and from October 1 that upfront charge applies to existing card and PayPal customers at the start of each billing cycle. Included usage may be prorated to match seat proration. Prices are explicitly not changing. Note also that revoking a seat still gets you no prorated refund.

September 28, 2026 — code review gets more expensive to run, quietly. The default effort level for Copilot code review changes from Lite to Balanced. Higher effort means more tokens, and tokens are what draw down your credit pool. If you want to keep Lite, you have to explicitly select it rather than leaving the setting on Default — GitHub says it will respect an explicit choice made before the 28th. This is the cleanest example yet of a cost increase delivered as a quality improvement.

September 28, 2026 — chat data retention goes from 28 days to the life of the account. Copilot Chat on github.com, Copilot Chat in GitHub Mobile and the cloud agent converge into one experience under one policy, enabled by default. The retention change is a consequence of github.com migrating to the agent sessions model. Opting out means losing Copilot on github.com and Mobile entirely. We covered this separately in your AI coding tool just started keeping your data longer.

September 1 — Copilot can now approve pull requests. Every Copilot code review now carries an approval assessment, and admins can authorise Copilot to submit an actual approval that counts toward a repository’s required-approvals rule. It is off by default and controllable at enterprise, org and repo level, including which file paths Copilot may approve; its approval is dismissed on new commits, like a human’s. Public preview on Pro, Pro+, Max, Business and Enterprise. Read that carefully before enabling it: a required-approvals rule exists so that a second party looks at the change, and this lets the tool that wrote the code sign off on it.

September 1 — Claude Fable 5.1 is GA, and it requires data retention. Available on Pro+, Max, Business and Enterprise, billed at provider list pricing under usage-based billing, off by default for orgs. Unlike other Claude models in Copilot, Fable 5.1 (and Fable 5) retain prompts and outputs so Anthropic can run its safety classifiers. Retained data is not used for training, and eligible enterprises get zero-retention access only through the end of the calendar year.

One more, undated: as of August 31, if you hold Copilot seats in more than one organisation, your model access is now decided solely by the org that pays for your usage — previously any org enabling a model was enough. Check “Usage billed to” on your Copilot features page if a model you were using disappears.

Sources: Copilot policies and billing, code review approvals, Claude Fable 5.1 GA, model access for Team plans.

New in August 2026: the promotional credits expire September 1

If you’re on Copilot Business or Enterprise, this is the section that matters. The elevated AI credit allowance that existing customers have had since usage-based billing started on June 1 runs out on September 1. Business drops from 3,000 included credits per user per month to 1,900. Enterprise drops from 7,000 to 3,900. Credits are worth a cent each, so that’s $11 and $31 per seat of included usage disappearing.

The seat prices don’t change — Business is still $19, Enterprise still $39. Two details make this sharper than it sounds: credits are pooled across the whole org rather than allocated per person, so nothing warns an individual that the team is running dry; and additional usage is enabled by default, meaning consumption continues past the pool at published rates and bills to you. Autocomplete and next edit suggestions stay unlimited and free of credits, so light users are unaffected. Agentic use is where the money goes. Full math and a pre-Tuesday checklist in the Copilot credit cliff guide. Source: GitHub Docs: usage-based billing for organizations and enterprises.

New in July 2026: Kimi K2.7 Code, the first open-weight model in the picker

On July 1, GitHub made Kimi K2.7 Code, Moonshot AI’s MIT-licensed 1-trillion-parameter open-weight coding model, generally available in the Copilot model picker. It’s the first fully open-weight model Copilot has offered as a selectable option, and on July 7 it expanded to Copilot Business and Enterprise plans (off by default there; an admin has to enable the policy first). GitHub hosts it on Microsoft Azure and bills it at provider list pricing under the usage-based system, which makes it one of the cheaper models in the lineup.

Why this matters even if you never touch Copilot: open weights are moving from “interesting for hobbyists” to a first-class, vendor-hosted option inside the tool most developers already pay for. For a founder, the practical read-through is cost and portability. A model whose weights are public and MIT-licensed is one you (or a vendor you hire) can self-host later without renegotiating a license, and it gives cost-aware teams a cheaper default for high-volume, lower-stakes work. It doesn’t change Copilot’s verdict for non-coders, but it’s another data point in the trend we keep flagging: model choice, provenance, and licensing are climbing the due-diligence list. Source: GitHub changelog: Kimi K2.7 GA, GitHub changelog: Business & Enterprise.

New in June 2026: Agent Finder and a standalone Copilot app (June 17)

GitHub shipped two things on June 17 worth flagging. The first is Agent Finder: instead of hand-wiring which MCP servers, skills, and tools each agent should use, and burning your context window doing it, Copilot can now describe a task in plain language, search an index of available capabilities, and pull in ranked matches on demand. It’s built on the open Agentic Resource Discovery (ARD) spec (developed with Google, Hugging Face, GoDaddy, and Microsoft), it never auto-installs anything, and your enterprise controls what it’s allowed to surface. It’s on all plans, free included. The second is that the GitHub Copilot app went generally available, a standalone desktop app that turns Copilot into a supervised control plane for agents rather than just an in-editor assistant.

For non-technical founders the practical takeaway is small but real: the MCP/agent ecosystem is getting a discovery layer, which is the first sign it’s maturing past “wire everything by hand.” But this is still very much developer plumbing. It doesn’t change Copilot’s verdict for this audience. Source: GitHub changelog: Agent Finder, GitHub changelog: Copilot app GA.

New in June 2026: Claude Fable 5 joins the model picker (Pro+, Business, Enterprise)

Anthropic’s new top model, Claude Fable 5 (released June 9), is now selectable in Copilot for Pro+, Business, and Enterprise tiers. It’s the strongest coding model on the market right now, at 80.3% on SWE-bench Pro, well ahead of GPT-5.5 and Gemini 3.1 Pro, so if you do heavy agent-assisted refactoring inside Copilot, it’s worth pinning for the hard tasks. The catch is cost: under the usage-based billing that took effect June 1, Fable 5 is a premium model metered by token consumption (API list price is $10/$50 per million input/output tokens), so leaning on it for everyday work will draw down your AI Credits faster than the cheaper models in the picker. The free and basic Pro tiers don’t get access. This reinforces Copilot’s real edge for anyone worried about lock-in: it’s the most model-diverse option going, now routing across Claude (including Fable 5), GPT, Gemini, and Microsoft’s own MAI-Code-1-Flash. Our Claude Fable 5 guide covers what the new model means for builders. Source: Anthropic, gHacks.

New in June 2026: Microsoft’s own coding model is real, and it’s called MAI-Code-1-Flash

Microsoft’s in-house coding model shipped at Build on June 2, and now we have the official name: MAI-Code-1-Flash, part of a new family of MAI models built by Microsoft’s Superintelligence team. (Pre-Build reporting, ours included, called this effort “Project Polaris” and claimed an August GPT-4 swap-out; the official record names no Polaris and sets no August deadline, so treat that framing as superseded.)

What’s actually confirmed, from Microsoft’s announcement and the GitHub changelog: MAI-Code-1-Flash is a small, fast, agentic coding model trained directly against the production Copilot harness, rolling out now to all Copilot tiers (Free, Pro, Pro+, and Max) starting in VS Code. It appears in the model picker and, more importantly, under the default Auto picker, which means Copilot may quietly route your everyday tasks to it. Microsoft claims it beats Claude Haiku 4.5 across coding benchmarks (51.2% vs. 35.2% on SWE-Bench Pro) while using up to 60% fewer tokens. Those are vendor numbers, so wait for independent testing, but the strategic move is unambiguous: Microsoft is reducing its dependence on outside models, starting with the cheap, high-volume tier.

One detail worth noticing: Microsoft says the model was trained on “clean and appropriately licensed data.” That’s the generated-code provenance story showing up in marketing copy, a sign that IP questions about AI-written code are now a selling point, not a footnote.

For founders, the takeaway is unchanged: Copilot is still a developer’s tool, not a non-coder’s. But two signals matter: model independence is now the category’s default move (a fair question to ask of any tool you build on), and generated-code provenance is climbing the due-diligence list. Our Build 2026 recap covers what to actually do about it.

New in June 2026: Usage-based billing replaces request limits

Starting June 1, 2026, all GitHub Copilot plans move from request-based limits to usage-based billing powered by GitHub AI Credits. The headline prices aren’t changing (Pro stays at $10/mo, Pro+ at $39/mo) but the accounting model underneath does.

The short version: code completions and Next Edit suggestions remain unlimited and don’t consume credits. What changes is how premium model usage (Claude Opus, GPT-4o, and similar) gets metered. It’ll now be calculated by token consumption rather than a flat request cap. For most developers running Copilot Chat at moderate volumes, this will look similar to the old model. For heavy users who regularly hit the previous 300-request monthly ceiling on premium models, it’s a mixed picture. Visual Studio Magazine documented early developer reactions: the common concern is that token-based pricing can become unpredictable, especially for teams doing code review and agent-assisted refactoring.

If you’re currently on an annual Pro or Pro+ plan, you stay on request-based pricing until your plan expires. Monthly subscribers flip over June 1. Worth logging in and checking your current premium request usage before the transition to understand what the change actually means for your workflow.

What Copilot does

The core experience is inline autocomplete: as you type, Copilot suggests the next line, the next function, or an entire block of code based on context from the surrounding file. Accept a suggestion with Tab, reject it by continuing to type. Over time it gets better at predicting your patterns.

Copilot Chat adds a sidebar where you can ask questions, request explanations, generate tests, or describe features you want to implement. It has access to your open files and can understand your project at a basic level. For developers who don’t want to leave their editor, this integration is convenient.

The GitHub integration matters

Where Copilot has a real edge over standalone AI editors: its integration with GitHub itself. You can use Copilot in pull request reviews, in GitHub.com’s interface, in GitHub Actions workflows. For teams already on GitHub, this creates a coherent AI-assisted workflow that doesn’t require adopting a new tool.

The honest comparison to Cursor

Copilot’s autocomplete is good. Cursor’s is better. This is almost universally agreed upon by developers who’ve used both. The gap narrows over time as Microsoft iterates, but if autocomplete quality is your primary criterion, Cursor currently wins.

Where Copilot competes is on price ($10/mo vs. $20/mo for the full Cursor Pro experience), ecosystem integration, and the simple fact that many developers already use it and have no reason to switch.

For non-technical users

This is the most honest thing to say about Copilot: it is not a tool for non-technical founders. It doesn’t generate apps, it doesn’t explain what software is, and it doesn’t hide the complexity of code from you. It makes developers faster. It does not make non-coders into developers.

If you don’t know what a function signature is, or how to run a local development server, Copilot will not help you build anything. The rating of 2 reflects the small minority of non-coders who have enough coding literacy to benefit. It’s not that it’s a bad tool, but that it’s the wrong tool for this audience.

Bottom line

Copilot is a solid, dependable AI coding assistant for developers. The $10/mo price is the most affordable entry point in the category. If you’re a developer already living in VS Code who wants AI assistance without switching editors or workflows, it’s a reasonable choice. If you’re a non-technical founder hoping to build without coding, look elsewhere.

Was this helpful?