You can now run a security review on your in-flight code changes directly from the GitHub Copilot app. The /security-review slash command is shipping in public preview, bringing the same…
Better tools made Copilot code review worse. Here's how we actually improved it.
How migrating Copilot code review to shared Unix-style code exploration tools reduced review cost by reshaping agent workflows around pull request evidence.
Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and GitHub Copilot Agent
Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent are vulnerable to prompt injection via GitHub comments — turning PR titles, issue bodies, and issue comments into attack vectors for API key and token theft.
Living With Our Machine Sidekicks
I’ve been using GitHub Copilot (and various other similar things) for a long while now, and I think it’s time to take stock and ponder their impact. It’s ...
GitHub Copilot · Plans & pricing
GitHub Copilot works alongside you directly in your editor, suggesting whole lines or entire functions for you.
Introducing the Open-Source Codex Security CLI
Codex Security helps security and engineering teams find, confirm, and fix vulnerabilities. Use its command-line interface (CLI) to scan repositories you own or have permission to assess, review findings over time, and check changes before they land. Quickstart Guide for an interactive scan Cloud set-up for connected GitHub repositories Link to the public repo: Codex Security This is an early release, and we’re listening to your feedback as we continue improving it. The Codex Security CLI ...
Code scanning shows AI security detections on pull requests - GitHub Changelog
GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. These detections help teams identify and…
CLI quickstart – Codex Security | ChatGPT Learn
Set up Codex Security, run a local scan, and review the report, findings, and coverage.
Copilot memory early access for Pro and Pro+ - GitHub Changelog
Copilot memory is now available in public preview for GitHub Copilot Pro and Pro+ users, with support in Copilot coding agent and Copilot code review. Copilot memory Copilot memory enables…
Agentic autofix for code scanning alerts in public preview - GitHub Changelog
Fix code scanning alerts faster with agentic autofix.
tuicr - TUI for Code Reviews
hunk — review-first terminal diff viewer
Hunk is a review-first terminal diff viewer for agent-authored changesets. Multi-file review stream, inline AI annotations, watch mode, and Git/Jujutsu integration.
GitHub - github/awesome-copilot: Community-contributed instructions, prompts, and configurations to help you make the most of GitHub Copilot.
Community-contributed instructions, prompts, and configurations to help you make the most of GitHub Copilot. - github/awesome-copilot
Supported AI models in GitHub Copilot - GitHub Docs
Learn about the supported AI models in GitHub Copilot.
Copilot prompt injection goes viral in your documents
All systems based on chatbots can be prompt injected. You can always tell the bot to do things it shouldn’t. The AI vendors try to put in guard rails. The guard rails sort of work for about two sec…
crawshaw - 2026-05-07
The industry-established code review process, review-then-commit, was a straightforward mechanism that allowed a relatively low-trust group of engineers to collaborate. It appears to have been initially developed for the Apache server OSS project in the 90s, corporatized by Google in the early 2000s, and popularized throughout the industry by several means, most notable of which was the GitHub PR.
