GitHub Copilot

What GitHub Copilot is

GitHub Copilot is an AI assistance and agent service for software development. It began with code completion; its current scope includes project conversations, file editing, task execution and review of proposed changes. GitHub provides the product with models from several suppliers.

Separate three elements: the product, which organizes access and tools; the model, which interprets context and generates responses; and the execution environment, where files are read or tests run. Choosing a model does not, by itself, determine the agent’s permissions or where information is processed.

GitHub Copilot has its own subscription and terms. It is distinct from Microsoft Copilot for general questions or office work, and from OpenAI’s Codex agent, although it can use technology or integrations from those suppliers. For an OSH team, it is relevant when a specific programming task supports preventive management.

Reference documentation: GitHub — Technical preview, June2021 · GitHub — Plans.

History and major milestones

On 29 June 2021, GitHub introduced a technical preview developed with OpenAI and initially powered by Codex. Visual Studio Code was the first environment. Support expanded to Neovim and JetBrains IDEs that October; Visual Studio 2022 followed on 29 March 2022. General availability by subscription began on 21 June 2022.

An earlier example of assistance inside an editor was Microsoft Research’s Bing Code Search for Visual Studio 2013, demonstrated in February 2014. It retrieved code samples from the web. This search approach provides historical context, but does not establish that Copilot is simply a new version of the same program.

• 2023: Copilot Chat expanded natural-language interaction. In November, GitHub announced its GPT-4 upgrade and general availability planned for December.
• October 2024: model choice expanded to Anthropic and Google offerings alongside OpenAI.
• 6 February 2025: agent mode in VS Code introduced sequences of edits and tool use.
• 19 May 2025: the coding agent added asynchronous work in a GitHub Actions environment, delivered through pull requests.
• 2026: Copilot CLI became generally available on 25 February and the desktop app on 17 June. In October, Fusion and projects expanded coordination across models, repositories and sessions.

This evolution changes what is delegated: completing a line, modifying a function and maintaining a background task require different context and checks. An old completion guide does not describe the whole current platform.

Reference documentation: GitHub — Technical preview, June2021 · GitHub — Universe2021 · GitHub — VisualStudio2022 · GitHub — General availability · Microsoft Research — BingCodeSearch · GitHub — Universe2023 · GitHub — Model choice,2024 · GitHub — Agent mode · GitHub — Coding agent · GitHub — CLI general availability · GitHub — Desktop app · GitHub — Universe2026.

Features and how it works

• Assistance with writing and explaining code.
• Support for development tasks and projects.
• Integration with programming environments and tools.

GitHub Copilot combines assistance during programming with agent capabilities. Inline suggestions propose code; chat helps explain or modify it; agents can investigate a repository, edit files, run tools and prepare changes for review. Available capabilities depend on the client, plan and organization’s policies.

Context includes project code and instructions. Output may be an explanation, a modification or a proposed change through a pull request. The latter allows differences and check results to be inspected before integration; an agent completing a task does not establish that the behavior is correct.

Reference documentation: About GitHub Copilot · Application card: GitHub Copilot Agents.

Models, context and code generation

The original Codex belonged to the GPT family and was adapted for code. Its 2021 research paper describes 159 GB of filtered Python from 54 million public repositories. HumanEval results were 28.8% with one sample and 70.2% with one hundred samples per problem. These are historical research-model results, not current Copilot accuracy.

The service now brings together models from OpenAI, Anthropic, Google, xAI and Microsoft, among others. Hosting and conditions vary by model; compatible local options also exist. Evaluate model and client separately: the same engine can receive different files, tools or instructions in two applications.

Fusion adds runtime selection and coordination. It may use one model, a cascade with review, or several critics examining a proposal. Selecting Fusion chooses this coordination system rather than fixing one model for the whole conversation.

Useful context combines the request, relevant code, conventions and tool results. Converting a Python function to another language, for example, requires more than preserving its appearance: empty values, dates, decimals and error handling must retain their meaning. A generated explanation can guide review; tests check concrete behavior.

Accuracy figures depend on the problem set, number of attempts and evaluation criterion. An early completion percentage cannot predict a current agent’s reliability in a particular repository.

Reference documentation: GitHub — Model choice,2024 · GitHub Docs — Copilot Fusion · GitHub Docs — Model hosting · Chen et al. — Codex research,2021.

Editors, terminal, desktop and mobile access

Supported clients include VS Code, Visual Studio, JetBrains, Eclipse, Vim/Neovim and Xcode, with differences across versions and features. The official matrix distinguishes completion, chat, agent mode, instructions, MCP and other capabilities. An extension supporting suggestions does not necessarily provide every workflow available elsewhere.

Copilot CLI places the agent in the terminal: it can plan, edit and execute tools under configurable permissions. Skills, custom agents, hooks and MCP servers extend the workflow. Assess extensions by the operations they authorize, not only their descriptions.

The Windows, macOS and Linux app supports parallel sessions with separate branches and worktrees, plus diff review. Business and Enterprise organizations must enable the Copilot CLI policy for access. The web and GitHub Mobile provide other entry points to conversations and tasks; they do not make a phone equivalent to the local build environment.

November 2026 brought Copilot to JetBrains Air through ACP, with separate requirements for cloud tasks. Integration with Xcode’s built-in coding assistant is in public preview from Xcode 27.3 beta and remains distinct from the existing extension.

Choose a client based on where files, dependencies and tests reside. If a task depends on software installed on one computer, moving it to the cloud requires reproducing that environment or narrowing the assignment.

Reference documentation: GitHub — CLI general availability · GitHub — Desktop app · GitHub Docs — Feature matrix · GitHub — Xcode assistant preview · GitHub — JetBrains Air.

Agents, projects and delegated work

The cloud agent can receive a task, work on a branch and propose changes through a pull request. Documented protections include write limits, checks and human review before merging. Code, dependency and secret scans help identify problems; their results need to be read alongside the proposed change.

A well-defined task specifies expected behavior and what must remain intact. “Fix date importing” is incomplete without accepted formats, time zone, optional fields and error behavior. A minimal example and expected result make it possible to check whether the agent solved the right problem.

App projects, in public preview, group an ongoing goal, sessions and materials. They can span several repositories or work without one. They help coordinate an investigation and its outputs when each finding retains a clear connection to its source.

Automations execute tasks on schedules, events or API calls. They currently require private or internal repositories, eligible plans and enabled policies. Configuration distinguishes identity, tools, triggers and spending limits. A recurring review should not acquire publishing permission merely because a person no longer starts every run.

For an auxiliary OSH utility, the assignment could detect changes in an export format and prepare an adaptation proposal. The team would then decide whether the difference changes meaning and should enter the process.

Reference documentation: GitHub — Coding agent · GitHub Docs — Projects · GitHub Docs — Automations · GitHub Docs — Cloud risks and mitigations.

Plans, licensing and usage

The offering distinguishes individual Free, Pro, Pro+ and Max plans from organizational Business and Enterprise plans. Students and other eligible groups have specific access conditions. A GitHub repository-hosting plan does not automatically provide an equivalent Copilot entitlement.

Since June 2026, usage has been measured through GitHub AI Credits. Cost depends on the model and input, output and cached tokens. Paid individual plans combine base credits with a variable flex allotment. Older guides based only on “premium requests” do not describe current billing.

Code review can also consume GitHub Actions minutes. Budget a pilot around conversations, delegated execution, reviews and retries, and check actual usage. A long assignment may require several calls even when the user submitted one message.

The service operates under commercial terms and account policies. An open component’s or model’s license neither replaces those terms nor automatically determines the license of generated code. Adding a dependency should preserve its name, version, origin and license.

Reference documentation: GitHub — Plans · GitHub Docs — Individual usage billing · GitHub — June2026billing change.

Data, privacy and file exclusion

Current settings allow GitHub to use Free, Pro, Pro+ and Max interactions for training unless the user opts out. This includes inputs, outputs, code snippets and context. Business and Enterprise customer data is not used to train models under their terms. Check the actual account rather than inferring its policy from the application’s logo.

A model-hosting provider may have retention conditions distinct from GitHub’s policies. Choosing a local model does not automatically make integrations, external tools or delegated tasks local. Identify which information leaves the device and which services receive it for the particular workflow.

Business and Enterprise content exclusion helps prevent designated files from informing suggestions or being read through Copilot-controlled tools. Current documentation includes agents but warns about indirect access and external MCP servers. It is not an operating-system permission boundary or complete isolation guarantee.

In an auxiliary OSH repository, separate code and test data from personal records. A synthetic sample can reproduce a formatting error without names or health information. Before connecting a source, decide whether the task needs its schema, sample records or the complete dataset: these represent different exposure levels.

Reference documentation: GitHub Docs — Model hosting · GitHub Docs — Individual policies · GitHub Docs — Content exclusion.

Research findings and learning

A trial published by Peng and colleagues in 2023, involving 95 developers, found a 55.8% reduction in completion time among those who finished a JavaScript HTTP server with Copilot. It measures a bounded task, not department-wide savings or long-term software quality.

A 2025 longitudinal study at NAV IT compared 25 users with 14 non-users. It found no statistically significant change in commit-based activity after Copilot adoption, despite favorable perceptions. Task completion time and recorded activity are different measures; neither alone captures delivered software value.

Pearce and colleagues’ 2021 research generated 1,689 programs across 89 security scenarios and found approximately 40% vulnerable. This concerns that version and experimental design. It demonstrates why plausible code needs analysis, not a universal failure rate for current suggestions.

The education debate also predates agents’ rise: the 2022 work The Robots Are Coming questioned programming assessment when machines can generate solutions. Internal training can ask learners to explain decisions, identify a fault and adapt to a new case, alongside submitting a finished file.

Evaluate adoption using total time to acceptance, escaped defects, review effort and maintainability. If generation saves ten minutes but review adds twenty, counting produced lines describes activity rather than improvement.

Reference documentation: Pearce et al. — Asleep at the Keyboard · Peng et al. — Productivity experiment · Stray et al. — Longitudinal study · ACM SIGCSE — Paul Denny interview.

Public code, licensing and controversies

Training on public code and potentially reproducing fragments have attracted controversy since launch. In June 2022, Software Freedom Conservancy launched a campaign to leave GitHub over its objections to Copilot. Developers also circulated Quake-related examples that year: specific criticisms and demonstrations, not an audit of all outputs.

The 2022 lawsuit against GitHub, Microsoft and OpenAI challenged attribution and licensing terms, among other issues. On 16 September 2026, the Ninth Circuit affirmed dismissal of certain DMCA copyright-information claims. This did not resolve all contract claims or grant blanket permission for every training practice or output.

Copilot can block public-code matches or display references depending on applicable policy. Its index excludes private repositories and does not cover all internet code. Inline references concern accepted, unchanged suggestions; a missing reference does not establish universal originality.

Practical review should distinguish whether code works, whether its origin requires attribution or conditions, and whether a dependency can be maintained. These are related but different checks. Preserving discovered references and licenses supports decisions to incorporate, replace or remove a fragment without treating an assistant’s response as a legal conclusion.

Reference documentation: GitHub Docs — Copilot in IDEs · GitHub Docs — Finding matching code · Software Freedom Conservancy — GiveUpGitHub · GitHub Copilot litigation — Plaintiffs · Ninth Circuit — Doe v GitHub,2026 · Drew DeVault — Quake code criticism.

Applications in occupational safety and health

Its connection to occupational safety arises when a technical team maintains utilities supporting preventive processes, such as transforming authorized exports or checking field consistency. It can accelerate programming work, but process rules and interpretation of the data must come from specialists and approved documentation rather than assumptions generated by the assistant.

In OSH, Sabentis proposes using it to maintain auxiliary utilities: validating authorized export structures, documenting data transformations or preparing tests for a calculation already defined by specialists. It can also explain an older script before modification. Its role is implementing known rules, rather than deciding which indicator represents risk or turning a data association into a preventive conclusion.

Worked example and checks

For example, a developer could request help writing a script that detects impossible dates in a copy of training records. They would review the code and test known cases before using it with real information.

1. Define an invalid date in the training export: format, required fields and permitted relationships between dates.
2. Create a fictitious file with valid, impossible, blank and ambiguous dates, alongside expected results.
3. Request a script that reads a copy, flags issues and produces a separate report without changing the original.
4. Review the code for day-month interpretation, empty-value handling and error messages.
5. Run the tests and compare results with expectations before using an authorized real export.

A completion date after a start date may be valid; a poorly described rule could flag it incorrectly. Include such cases in the tests. The deliverable should explain what was checked, what was excluded and how to repeat the run. Detecting a formatting anomaly does not establish that training never occurred. Keep the output tied to the input version so reviewers can reproduce each reported issue.

A fictional twelve-row test set could contain seven valid rows, two impossible dates, one missing required date, one ending before it starts and one ambiguous date such as 03/04/2026. Expected output is seven accepted rows, four defined issues and one awaiting clarification: all twelve retained. If a day/month/year configuration resolves the ambiguity, the result becomes eight accepted rows and four issues, without deleting or creating records.

Output should include row identifier, applied rule and original value. A deliberately failing test checks that the test mechanism detects errors; running only successful examples can create false confidence. This is a hypothetical acceptance design, not a test performed on Sabentis data.

Limitations and conditions of use

Suggestions can contain bugs, unsuitable dependencies or unstated assumptions. Code still needs review, testing and security controls; credentials and clinical information should not enter the development context without suitable authorization and configuration.

Code may look correct yet produce wrong results, introduce unnecessary dependencies or ignore edge cases. Assisted review can also miss faults or flag nonexistent problems. Agent protections and automated scans do not amount to a security guarantee. Review differences, tests and context before integration, particularly when the program handles sensitive information or shared systems.

Reference documentation: Application card: GitHub Copilot Agents.

Choosing and complementing the tool

Choose GitHub Copilot when the team already uses repositories, change review and tests, and can express acceptance criteria. Excel can support inspection of samples and results; Codex is another catalog tool for development tasks. Compare workflow fit and available controls, without assuming that a model removes the need for technical review.

Useful adoption starts with small, repeatable tasks. Measuring detected errors and review time is more informative than counting generated lines. Keeping requirements and tests alongside code helps future modifications preserve the meaning of the rules. A test that merely repeats the implementation’s assumptions offers less protection than independently specified examples with known outcomes.

Frequently asked questions

Is this the same product as Microsoft Copilot?

No. GitHub Copilot focuses on software development; features and conditions from other Copilot experiences should not automatically be attributed to it.

Is an agent-created pull request ready to merge?

It is ready for review. Check requirements, differences, tests and effects before merging.

Can it define OSH rules on its own?

That decision should not be delegated to it. Rules should come from responsible people and approved documentation; the assistant helps implement them and check their behavior.