What’s New With GitHub Copilot Coding Agent 2026: Models, Self-Review, Security, Custom Agents, and CLI Handoff

Open an issue, return to a pull request

You open an issue before lunch. By the time you are back, there is a pull request waiting. That is the promise of GitHub Copilot coding agent. It works in the background on the tasks you delegate, from bug fixes and unit tests to refactors and cleanup, then comes back with a PR when it is done.

While you are coding in your editor with Copilot in real time, the coding agent handles the asynchronous work. Recent updates make that handoff smoother, safer, and easier to review. Here is what changed and how to put these features to work.

Choose the right model for every task

The Agents panel now includes a model picker. Previously, every background task ran on a single default model. You could not trade off speed for quality or upgrade for a harder job. Now you can match the model to the task.

Use a faster model for straightforward chores like adding tests or fixing small lint issues. Upgrade to a more capable model for complex refactors, multi-file changes, and integration tests with tricky edge cases. If you would rather not tune anything, leave it on auto and let the system decide.

When to pick which model

• Speed-first tasks: unit tests for pure functions, small bug fixes, routine formatting.
• Quality-first tasks: deep refactors, cross-service changes, test suites with mocks and fixtures, migrations.
• Auto: when you are unsure or want the agent to choose based on context.

How to get started

• Open the Agents panel in GitHub, select your repository, and pick a model.
• Write a clear prompt that defines scope, constraints, and success criteria.
• Leave model selection on auto if you prefer set-and-forget behavior.

Model selection is available for Copilot Pro and Pro+ users now, with support for Business and Enterprise planned.

Pull requests that arrive in better shape

The hardest part of reviewing agent output is often the cleanup. You open the diff and see logic that works, but reads in a way no teammate would ship. The latest release adds self-review with Copilot code review before the PR opens, so the agent iterates on its own work first.

The workflow looks like this: the agent drafts a patch, requests feedback from code review, then applies suggested improvements. By the time the PR is ready for you, the low-level nits and awkward patterns are already addressed. In one session, the agent even caught that its own string concatenation was too complex and fixed it before it reached review.

What this improves

• Less review thrash: fewer rounds of comments for naming, style, and simple logic cleanup.
• Higher baseline quality: more idiomatic code and clearer diffs from the outset.
• Faster merges: maintainers can focus on correctness and domain details, not polish.

How to see it in action

• Assign an issue to Copilot or create a task from the Agents panel.
• Open the task and view the session logs as the agent works.
• Look for entries where the agent runs code review and applies feedback.
• Review the pull request when prompted, after the agent has iterated.

Security checks that run while the agent works

AI-generated code can introduce the same risks as human code, only faster. That includes vulnerable patterns, secrets in commits, or dependencies with known CVEs. The coding agent now runs code scanning, secret scanning, and dependency vulnerability checks as part of its workflow, so issues are flagged before the pull request opens.

This shifts risk detection left. If a dependency is unsafe, it gets flagged early. If a change looks like it contains a token or API key, the session logs show the alert. Code scanning features that are typically part of GitHub Advanced Security are included in the agent’s workflow, so you get coverage without extra setup.

Security benefits

• Early alerts: vulnerabilities and secrets are caught during task execution.
• Cleaner reviews: you review a PR that has already passed baseline security checks.
• Fewer regressions: the agent is less likely to ship risky patterns by accident.

How to verify checks

• Run any task through the Agents panel.
• Watch the session logs for code scanning and secret scanning entries.
• Open the PR and confirm the security checks have passed.

Custom agents that follow your team’s process

Short prompts leave a lot to interpretation. Team conventions, performance expectations, and testing standards can be hard to communicate in a sentence or two. Custom agents let you encode that process in the repository itself, so the agent behaves consistently across tasks.

Create a file under .github/agents/ to define a specialized agent. For example, a performance optimizer agent can benchmark first, make a targeted change, then measure again before opening a PR. In a recent demo, that approach produced a 99 percent improvement for a specific function by keeping scope tight and decisions data driven.

Where custom agents help

• Performance tuning: benchmark, change, re-measure, report the delta.
• Security hardening: enforce patterns, run checks, provide remediation notes.
• Migration playbooks: codify step-by-step changes, tests, and validation gates.
• Documentation updates: ensure formatting, links, and style rules are applied.

How to create and share

• Add an agent file under .github/agents/ in your repo to define behavior and steps.
• Open the Agents panel, start a new task, and select your custom agent.
• Write a prompt scoped to that agent’s purpose, for example, optimize this function and report before-after timings.
• Share the agent across your organization so teams use the same process everywhere.

Move between cloud and local without losing context

Sometimes you begin a task in the cloud, then want to finish it locally. Other times you are deep in your terminal and want to hand work back to the agent without breaking flow. The new cloud-to-local handoff lets you move sessions between environments and keep the branch, logs, and full context intact.

You can pull a cloud session down to your CLI, continue investigating, push updates, and then send the work back to the cloud. Pressing the ampersand symbol in the CLI delegates background work to the agent while you keep going locally. No need to restart the conversation or rebuild state.

How to shift contexts

• Start a task with Copilot coding agent and wait until the session is created.
• Click Continue in Copilot CLI to copy the command.
• Paste it in your terminal to load the session locally with branch, logs, and context.
• Press & in the CLI to delegate work back to the cloud and continue locally.

Practical tips to get more from the coding agent

These features are most useful when paired with clear prompts and consistent scope. Treat the coding agent like a teammate who thrives on good context and crisp definitions of done. Small, well-defined tasks tend to ship faster and cleaner than giant refactors.

On top of that, lean on the new tools. Pick a model that matches the job. Use custom agents to encode the steps you want followed. Check logs while the agent runs, then do a focused review once it opens a PR.

Prompts that work well

• State the goal and constraints: what to change, what not to change, and why.
• Define done: tests pass, benchmarks improve by X percent, docs updated.
• Provide context: related files, architectural notes, known edge cases.

What this adds up to

Copilot coding agent has come a long way. Model selection lets you trade speed for depth when you need it. Self-review improves diffs before they reach you. Security scanning runs during task execution, not after. Custom agents turn playbooks into code. CLI handoff keeps you in flow as you move between cloud and local.

The roadmap is active too. The team is working on private mode, planning before coding, and using the agent for tasks that do not need a pull request, such as summarizing issues or generating reports. That means more autonomy for routine chores, while you stay focused on design and product work.

Key takeaways

• Pick the right model for each job, or leave it on auto if you prefer simplicity.
• Expect cleaner PRs thanks to built-in self-review that runs before you are tagged.
• Rely on integrated security checks to catch vulnerabilities and secrets early.
• Codify your workflow with custom agents under .github/agents/ for repeatable results.
• Swap contexts without friction using the CLI handoff to move sessions between cloud and local.
• Write clear prompts and keep scope tight to ship faster with fewer review cycles.

With these updates, GitHub Copilot coding agent becomes a more capable partner for background development work. Delegate the right tasks, give it the context it needs, and review with intention. The payoff is faster iteration and higher quality changes, ready when you return.