GitHub upgrades Copilot coding agent with model selection, self-review, security checks, and CLI handoff

What GitHub announced on X

On March 17, 2026, GitHub opened an X thread by saying you should be able to file an issue before lunch and come back to a pull request. That framing matters because it treats Copilot coding agent less like an autocomplete tool and more like a background worker that can take delegated tasks, execute them with policy, and hand results back in reviewable form.

What the GitHub blog adds

GitHub’s official blog post, published on February 26, 2026 and resurfaced in the March 17 thread, breaks the upgrade into several concrete workflow changes.

• Model selection: users can choose the model in the agent panel instead of leaving every task on a single default; GitHub says this is live for Copilot Pro and Pro+ first, with Business and Enterprise support coming later.
• Self-review: the agent now reviews its own changes with Copilot code review before opening a pull request, then iterates on the patch.
• Security checks: code scanning, secret scanning, and dependency vulnerability checks now run directly inside the agent workflow before the PR opens.
• Custom agents: teams can define task-specific behavior under .github/agents/, such as benchmarking before and after a performance change.
• Cloud-to-CLI handoff: developers can pull a cloud session into the terminal with its branch, logs, and context, or press & in the CLI to push work back to the cloud.

Why this matters

The upgrade makes coding agents more practical to delegate. Model choice, self-review, and pre-PR security checks all reduce the cost of trusting an agent with more consequential work. Instead of only generating code, the agent is now expected to select an execution path, critique its own patch, and surface fewer surprises to human reviewers.

It also signals where developer tooling is heading. The important shift is from “AI helps me write code” to “AI executes a scoped development workflow with policy and handoff points.” If that pattern holds, the differentiator for coding agents will be less about raw generation quality alone and more about reviewability, safety checks, and how well agents move between cloud execution and local developer context.

Sources: GitHub X thread · GitHub blog