What did GitHub announce at Universe 2026?
GitHub used its annual Universe conference on 28 October 2026 to argue that its job has changed. The platform no longer just stores code and runs builds. It now claims to finish features, fixes and chores end to end. Agents do most of the typing.
Jay Parikh is executive vice president of CoreAI at Microsoft. He set out the plan in a GitHub blog post. The centrepiece is Copilot Fusion, a routing layer that chooses models for each step of a coding task. It became generally available that day.
Fusion is not a new model. It is an orchestration service that combines the earlier HydraFusion project with automatic model selection. It ships in Visual Studio Code, JetBrains IDEs, the GitHub Copilot app and the command line.
GitHub also showed a rebuilt Copilot app built around Projects. A project gathers context, agents and results in one place. It can accept repositories, design mocks, Slack threads or meeting notes. Agents work in parallel across repositories and hand back pull requests for review.
Session continuity lets one cloud session move between the desktop app, the editor, the terminal and the browser without restarting. Automations run repeatable jobs and propose improvements for a person to approve. Computer use is in public preview on macOS and Windows. It requires approval before Copilot takes control of an app, and organisations can switch it off.
GitHub made one review claim worth checking later. Copilot code review Max is said to hold the highest F1 score on ReviewBench for high-severity issues. That is a vendor benchmark, not a public leaderboard.
The infrastructure numbers were the most concrete part of the keynote. GitHub says it added 4 million CPU cores and 160 petabytes of high-speed storage this year. It also added 50 terabits per second of network capacity. The company is moving to a multi-region deployment on Azure, due to finish early next year.
Parikh framed the change as a shift in the developer's role. He wrote that developers have gone from "writing every line of code" to "working with AI assistants." He also wrote that all software written to date would amount to less than 1% of what is written in the next five years.
The pitch matters beyond GitHub's customers. Changes to Copilot's defaults reach any team that stores code on the platform. That includes open source maintainers who never attend the keynote.
How many pull requests do AI agents open now?
GitHub published its Octoverse report the same day. Its numbers explain why capacity dominates the keynote. Developers pushed code 17.9 billion times in the 12 months to 30 September 2026, more than in 2024 and 2025 combined. They made 34.3 billion commits and merged 1.3 billion pull requests, about 3.5 million a day.
GitHub now serves more than 225 million developers. The United States accounts for 38.3 million of them and India for 32 million.
Activity accelerated sharply inside that window. GitHub counted 7.4 billion commits in September alone, The Register reported. That was five times the figure a year earlier. Simon Willison notes that new repositories were created at roughly 30 million a month, double the 2025 rate.
The more telling figure is who starts the work. More than 40% of pull requests in September began with a draft from an agent. That was up from 17% in March. The Next Web reports that this came to 110 million agent-started pull requests in September alone.
The count rests on GitHub's own instrumentation, not an outside audit. It measures drafts that agents start, which is why GitHub describes the result as a floor. The company says it cannot detect every agent, so the real proportion is probably higher.
Automation reaches the rest of the pipeline too. Actions ran 45.4 billion jobs in the same 12 months, and more than 30 million Dependabot pull requests were merged.
Model choice is fragmenting as well. In September, 61% of GitHub Copilot users used more than one model. Simon Willison notes that paid users tried 47 distinct models that month, excluding automatic selection.
Language use shifted at the edges. TypeScript added 3.62 million monthly contributors year on year and stayed the most used language. Python added 3.23 million and JavaScript 1.82 million. Rust grew fastest among the largest languages, doubling in a year, according to The Next Web.
These totals change where the queue forms. Writing code is cheaper than it was, so review and merge capacity absorb the pressure. A platform that once worried about storage now worries about how many diffs humans can read.
How good is Copilot Fusion on an independent benchmark?
Independent measurement now exists for the Fusion claim. Artificial Analysis ranks coding agents on a composite index built from three benchmarks with equal weight.
The index combines FrontierCode v1.1, Terminal-Bench 4.0 and SWE-Atlas-QnA. FrontierCode contributes 100 software tasks from Cognition. Terminal-Bench contributes 66 terminal tasks from the Laude Institute. SWE-Atlas-QnA contributes 124 technical questions from Scale AI, with grading adjusted by Artificial Analysis. Each benchmark score is the mean of three attempts per task.
On that index, Copilot Fusion in Max mode scores 59.9 out of 100. Claude Code with Opus 5.5 Max scores 61.7. GitHub's claim of landing within two points therefore holds up under third-party testing.
The cost gap is wider than the quality gap. Artificial Analysis puts Fusion Max at $5.59 per task. The Opus 5.5 configuration costs $11.42 for the same work, a saving of 51%. Fusion also finished faster, at 2,167 seconds of agent runtime against 3,661 seconds.
- •Fusion Max: index score 59.9, $5.59 per task, 2,167 seconds of agent runtime
- •Claude Code with Opus 5.5 Max: index score 61.7, $11.42 per task, 3,661 seconds
- •Devin Fusion CLI with Opus 5.5 Max and GPT-6 Luna: index score 61.5, $8.00 per task
What does GitHub claim about Fusion's speed and cost?
GitHub rounds these results to a score of about 60 at roughly half the average API cost. It says Fusion also takes about 40% less time per task. Satya Nadella went further on LinkedIn, according to The Next Web. He claimed frontier-level quality at up to 77% lower cost.
The 77% figure describes a best case rather than the measured average. The benchmark also prices raw tokens, not subscriptions, and most developers buy Copilot on a plan.
Cost figures depend on caching as well. Fusion Max hit a 97% prompt-cache rate in the benchmark. Artificial Analysis notes that cache pricing can move effective cost sharply between providers.
Fusion exposes three effort levels: Standard, High and Max. It also offers three orchestration patterns: Single, Cascade and Critique. Administrators can restrict which models their organisations may use, which matters when code leaves the building.
The index has limits of its own. Artificial Analysis warns that two agents with similar scores can differ sharply across repository work and terminal tasks. A single number hides real variation.
GitHub's framing also differs slightly from the benchmark. Its post compares Fusion with competitors generally, while Artificial Analysis compares specific configurations of each agent.
Why did GitHub's reliability slip in 2026?
The capacity build-out answers a difficult year. GitHub's 90-day availability fell to about 84% on 7 May. The Register cites reconstructed status page data for that figure. Its reporting also lists significant outages in February, April and August.
GitHub's monthly post-mortems fill in the detail. On 6 August, Actions failed for about nine hours after a deployment cut pod capacity. The change saturated service-mesh sidecars. A latent bug that made runners retry invalid jobs made things worse.
On 17 August, the front door and API failed for roughly six hours and 44 minutes. Traffic pushed load balancers past their limits. A client retry bug amplified the surge against authentication endpoints. On 20 August, Copilot's cloud agent showed stale status for nearly 11 hours after a database provider outage.
Two more incidents landed that month. On 26 August, Actions runs started late for almost three hours. A database primary had passed its tipping point, and no automatic circuit breaker existed. On 27 August, 63.3% of requests to the Kimi K3 model failed for about two hours and 50 minutes. The upstream provider had degraded.
September brought two shorter outages. A background cleanup job saturated shared database connections on 13 September. That affected about 96% of web issue creation for roughly two hours. A bad rollout left Copilot code reviews stuck on 28 September for about two hours and 45 minutes. Monitoring missed the missing results.
Remediation is mostly unglamorous database work. GitHub moved 24 authentication tables off its oldest database, removing about one million queries per second from replicas. It deleted roughly 980 million edit-history rows, freeing 1.8 terabytes. Weekly deadlocks fell about 77% from the June peak.
The architecture is changing as well. GitHub is separating storage from compute, a split The Register reports should deliver 35 times more throughput. It is also spreading load across Azure regions. GitHub's August report states the priority order plainly: availability, then capacity, then features.
Capacity alone will not fix review. The platform can store and build more code than its users can read. The October data shows that gap widening.
The practical effect lands on continuous integration and review queues. An Actions slowdown delays every merge behind it. A stalled review leaves pull requests waiting on a bot that never answers.
One caveat matters for anyone citing the 84% figure. GitHub's reports describe incidents in detail but do not publish a single uptime percentage. The 84% low comes from reconstructed status data, so treat it as an indicator rather than an official score.
What changes for enterprise Copilot customers?
For enterprises, the larger change is commercial. From 28 October, every licensed GitHub Enterprise user gets access to all Copilot features. No separate Copilot subscription is required.
The catch is billing. There is no included allowance. Companies set a budget and pay for the AI credits their users consume. Administrators can cap spending, with alerts at 75%, 90% and 100% of the configured limit.
Code completions keep working when a budget runs out. Chat and code review pause until the next cycle. GitHub says exhausting a budget never removes seats or features that do not depend on it.
Customers without an Enterprise licence can buy Copilot Standalone at $10 a month. That plan has no monthly credit allowance. Existing Copilot Business and Enterprise subscriptions continue, and self-serve availability for the new model will arrive in stages.
Credits draw down at one cent each, so a $10 budget covers 1,000 credits. GitHub is also discounting model costs for Fusion by 30% for a limited time.
Budgets now replace seat counts as the planning unit. That moves forecasting from procurement to engineering leaders. They must estimate token demand per team instead of a fixed price per developer.
The model also changes budgeting conversations. A team that adds agents can double its usage without adding a seat. Finance then sees spend rise on a contract that looks unchanged.
Do the new security tools stop bad AI code?
GitHub shipped two security tools aimed at agent-written code. AI Scan for pull requests became generally available on 15 October. It looks for vulnerabilities in languages that CodeQL does not cover.
Those languages include PHP, shell scripts, Terraform, Dockerfiles, JSP and Blazor. AI Scan explains each finding and suggests fixes, but its results are advisory. They cannot block a merge through ruleset requirements or checks.
Public repositories can use AI Scan without a licence. Private repositories need GitHub Code Security or GitHub Advanced Security, and usage draws on AI credits.
The package firewall entered public preview on 20 October for GitHub Enterprise Cloud customers. It sits between developer machines and the npm registry. Package metadata and downloads are checked against the GitHub Advisory Database. Administrators can set cooldown periods and grant exceptions.
The design assumes agents install dependencies without a human watching. Automated installs are the weak link, and GitHub plans to charge by metered usage once the preview ends.
The exposure is growing with agent adoption. Agents install packages, regenerate lockfiles and open pull requests at machine speed. That is why GitHub pairs detection with install-time blocking.
Neither tool closes the loop alone. An advisory scanner and a single-ecosystem firewall reduce exposure, but merge policy still rests with people.
What should developers watch next?
The next milestone is the Azure migration, which GitHub expects to complete early next year. Until then, the extra cores and the storage split remain promises.
Watch whether the benchmark gap survives contact with real repositories. The Artificial Analysis index blends three evaluations. Agents often trade strength in repository work against terminal tasks.
Watch the bills too. Credit-based pricing makes heavy agent use visible. The first enterprise budget overruns will show how generous the model feels in practice.
Competition is moving in parallel. CodeRabbit raised $143 million in August to expand AI code review, according to The Next Web. That is a sign review itself is becoming a market.
Watch the next Octoverse as well. If the agent share keeps climbing while merged pull requests grow more slowly, review capacity becomes the constraint that matters.
For now, three numbers frame the story. Agents start four in ten pull requests. GitHub is spending heavily to carry that load. The price of model output is falling faster than the price of trust.