Curated by 
Wren from the readings of Matt Klosterman
Wren from the readings of Matt KlostermanKey developments from this week’s sources.
Patterns that evolved across multiple sources this week.
GitHub Copilot Fusion is now generally available: developers select Fusion, and Copilot decides which model handles each task. New models also landed in Copilot, Amazon Bedrock, and direct vendor APIs the same week. Unless your own routing table defines which tasks go to which model, and the Copilot client logs which model it chose, that choice now belongs to GitHub.
Greptile now uses GPT-6 Astra to test the user workflows a change touches, and CodeRabbit's security agent uses GPT-6.1 Sol to dig into risks across large codebases. A reviewer's flag or a test score only counts once the running system confirms it. The AI that grades an agent during training should not also be the one that reports on how well that agent works.
GitHub Copilot now lets agents sign in as a GitHub App installed on an organization, not as a person, in public preview. Search tools that only reach approved domains and offline training setups limit each agent in the same way, through its own credential and settings instead of prompts or permission clicks. An agent still running on a personal token or with open web search is now an exception someone chose to allow.
Human spot-checks of AI agent work only count as an independent check if reviewers record their own call before seeing the agent's answer. Anthropic's research on how agents shape expert judgment found that agent output measurably shifts the decisions of the specialists reviewing it, which raises the risk of overreliance. A reviewer who reads the agent's answer first is no longer a second opinion.
Anthropic hit Git performance limits at about 30,000 pull requests per day and built its own source control system, Scion, which it is not open-sourcing. That figure comes from one newsletter interview, so treat it as reported, not confirmed. Storage also breaks at the rate AI agents make changes, and the labs that fixed it are keeping those fixes in-house too. Any team running AI agents at volume should measure its own merge and test pipeline load now instead of waiting for a public tool.
GitHub has made Copilot Fusion generally available. A developer now selects Fusion instead of a model, and Copilot decides which models handle each task [32]. Platform teams have been building that decision into their gateway (the internal proxy that every model call passes through). Fusion now makes it by default inside the IDE and CLI. Developers no longer have to choose a model for every task, and GitHub sees more traffic than any one team does. The downside is that cost attribution and the working approved-model list move into a router the organization does not own. Under Fusion, a new model can start writing your code without ever showing up in a picker.
GPT-6.1 Terra is generally available in Copilot as a cheaper option than GPT-6.1 Sol for agentic coding [23], and on Amazon Bedrock [24]. Kimi K3.1 Pro charges twice as much for a Highspeed variant that runs 2-3x faster [10]. API credits bundled into subscriptions also give developers model access that never touches the gateway [38].
Fusion runs inside the vendor client, not an inference proxy, so the gateway sees nothing unless Copilot reports which model it picked. The platform team owns the routing table, while Fusion's setting and logs belong to whoever administers Copilot org policy. If those are different teams, the two approved lists drift apart. This is in progress (act now): Fusion's default is being set right now, and GitHub will set it if nobody else does.
Check whether Copilot Fusion records which model handled each task; without that record, you can't track cost per task by model or judge model quality for Fusion requests.
Watch for API credits bundled into developer subscriptions: developers can use them to call new models directly, and that spending never shows up in your AI budget tracking.
Is Copilot Fusion on, and can you see which model handled each task?
Open your GitHub Copilot policy settings this week and check whether Fusion is enabled, then check whether your usage data shows which model served each request. If Fusion is routing tasks with no per-task model record, you can't attribute costs to the right model or confirm work stayed on your approved-model list. The result is spend you can't explain and possible policy violations you won't see.
Can developers use GPT-6.1 Terra or Kimi K3.1 Pro without approval?
Check three access paths this week: the Copilot model list, Bedrock model access, and direct API keys or subscription credits. If any of them lets a new model run before anyone signs off, your version-controlled approved list isn't the list people actually use. That leaves unreviewed models handling company code.
“Many required steps, however, leave the records unchanged, so an assistant that skips them can still be judged successful.”[3][9]
Greptile and CodeRabbit now sell code reviewers that run the change instead of only reading the diff. Greptile uses GPT-6 Astra to test the user workflows a change touches [19]. CodeRabbit's security agent uses GPT-6.1 Sol to investigate risks across a codebase and gives developers its findings along with proposed fixes [20]. To run anything, the reviewer needs an environment, credentials and data, so it becomes a CI stage, and the platform team has to give it its own service identity. The benefit is that a bug is shown to fail in the running system rather than inferred from the text of the diff. The cost is a new actor in the pipeline that holds credentials and can reach whatever its test environment can reach. There is no shared standard yet for limiting that reach (in progress, since vendors ship it now; surface: tool calls from CI).
Separately, database grading, which checks the system's actual end state rather than the agent's "done" message, is now used as the reward when agents are post-trained with reinforcement learning [3]. TauIndianBankBench (a benchmark for tool-using agents) grades the steps an agent took as well as the end state [9]. A grader that an agent was trained against is no longer independent evidence about that agent, so the grader used for reporting has to stay fixed and outside training (early-stage: watch). Public indices don't close that gap. Artificial Analysis v5 saturates or drifts away from the work buyers actually do [31], and model-as-judge setups still need their own validation [27].
Check which secrets and environments AI code reviewers like Greptile and CodeRabbit ask for once they run your code in CI. If that access keeps growing, it becomes a new way for passwords and keys to leak.
Look for vendor test results where the model was scored by the same database check that rewarded it during training. A score from the grader the model trained against is not an independent result.
Does your AI code reviewer run code, and which CI secrets can it reach?
List every environment variable and credential that Greptile, CodeRabbit, or a similar reviewer can access in your CI pipeline. A reviewer that runs code and has broad CI secrets acts as a credentialed user that nobody has inventoried. One malicious pull request could get it to leak deploy keys or cloud tokens.
Does the grader that trains your AI agents also score them?
Check every end-state or database grader you use as a training reward, and see whether it also produces the eval numbers you report. If one grader does both jobs, the model has been tuned to pass that exact check. Its scores then show how well it learned the grader, not how well it does the task, and progress reports built on them will overstate real capability.
“Services and agents built with the GitHub Copilot SDK can now make requests on…”[28][14]
GitHub now lets agents act as themselves. Copilot supports server-to-server authentication for GitHub Apps installed on organizations, so agents built on the Copilot SDK make requests as the app instead of as a person [28]. Before this, a bot that took a risky action on a developer's personal token was logged as that developer, who wasn't there. Now each action traces back to the agent, and the agent can reach only what its installation scope grants. The cost is migration work plus more app installations to inventory. The feature is in public preview (in progress, act now).
Separately, AWS added domain filtering and user-location controls to Web Search on Bedrock. Both are set on the web_search tool in the OpenAI Responses API request [14], so the allowlist lives in config a platform team can version, not in an instruction the model may ignore. Copilot assisted permissions, now generally available, explain each command, file path, or URL before the developer approves it [22]. That makes it a better prompt, but it is still a prompt. Containment still comes from the local sandbox that shipped in October.
The GitHub app in Teams lets a channel turn an issue into a Copilot fix [13], so a chat message can now start an agent. The platform team owns app installations and search-tool config, and both can be audited outside the prompt.
Watch whether the server-to-server login preview lets you limit an app's access to less than the whole organization; if access stays org-wide, giving the app its own identity improves tracking but doesn't reduce what it can reach.
Watch chat tools that can start AI agents, like Copilot in Teams: a channel message that kicks off an agent is a new starting point to log, just like PRs and command-line sessions.
Which AI agents still use personal GitHub tokens or unfiltered web search?
List every AI agent's credentials and search-tool settings this week. Each personal GitHub token, and each search tool with no domain filter, needs a named owner and a written reason. If one has neither, nobody decided to give that agent that much access.
“Deciding what should happen next and making plans the agents could act on.”[33][41]
Anthropic found that AI agents' output shifts the judgment calls of the experts reviewing it, which leads reviewers to rely on the agent too much [33]. That undercuts the operating model many organizations are moving to, where automated pipeline checks gate every change and humans review a sample plus flagged exceptions. If the reviewer reads the agent's answer first, the sample measures how persuasive the agent is, not whether it was right.
Volume makes it worse. Octoverse 2026 figures reported at GitHub Universe show merged pull requests now reaching 220 million per month per month [30]. Martin Fowler writes that experienced developers are wary of agentic development (agents writing and changing code with little step-by-step direction) because built is not the same as working in production [41]. He also notes that readers stop reading closely once text feels machine-generated [40]. A reviewer who has stopped reading still clicks approve.
The fix is slower. Reviewers record their own call before seeing the agent's, and deliberately injected errors — cases where the agent's answer is known to be wrong — show whether reviewers still catch the mistake. Engineering leads own that protocol. The platform team owns a gated field in the review UI that hides the agent's answer until the human commits, though no mainstream review tool enforces this today. This is early-stage (watch): a sample without independent calls stays unmeasured until the seeded cases show it works.
Track how often reviewers agree with AI agent output: if agreement keeps rising but fixes after merge don't drop, reviewers are following the agent, not catching more mistakes.
Track how many merged pull requests each reviewer signs off on as agents produce more code; the more reviews each person handles, the more they lean on the agent's judgment.
Do your reviewers decide before they see the AI agent's answer?
Audit your review flow for two things: reviewers record their own judgment before the AI agent's output is shown, and known-wrong answers are mixed into the sample on purpose. Without the first, reviewers tend to agree with whatever the agent said. Without the second, you can't measure how many errors your sampling program actually catches.
Merge queue depth is the metric that predicts when source control load management matters—the labs already solved it; your system's growth pattern is writing when you'll need to implement it.[2][11]
Anthropic built its own source control system, Scion, after Git performance broke down at around 30,000 pull requests per day, and it has chosen not to open-source it [2]. Separately, OpenAI reports scaling Habitat, its online storage layer, to 12x faster reads using multi-tenancy, global caching, and Azure Cosmos DB [11]. The Anthropic figure comes from a single newsletter interview, not a published benchmark. Even so, it is the most specific number available on where shared history stops scaling once AI coding agents (models that write and submit code on their own) produce the changes.
Both fixes stay inside the lab, and no vendor or upstream Git release fills the gap. Building custom source control buys throughput, but it brings a permanent maintenance burden that no one outside will share. Waiting costs nothing until the merge queue backs up and agent branches start failing rebases one after another.
Merge and CI contention is shared across the whole repo, so this belongs to the developer platform team rather than to individual teams. For most organizations it is early-stage (watch). Measuring it is cheap now, though: tag agent branches in the merge queue and CI scheduler, then compare their rebase retries, queue wait, and CI minutes against human branches.
Track how long AI agent branches wait to merge and how often they need rebasing, compared with branches written by people. If agents' numbers keep climbing faster, the shared code history is becoming the bottleneck.
copilot-utils is a collection of reusable, model-agnostic prompts and lightweight custom agents for GitHub Copilot that improve code review, refactoring, and documentation tasks without requiring Copilot Extensions or custom plugins. Drop-in quality-of-life improvements.
Wren from the readings of Matt Klosterman