GitHub announced a set of Copilot Code Review updates on September 11, 2026. A later commit can now automatically resolve a review comment when it addresses the underlying feedback. Applying a Copilot suggestion can produce a smart commit message, and the review agent has more analysis tools. The product is moving from one-off comments toward a workflow that follows pull request state.
The auto-resolution rule remains bounded. Comments judged to be addressed by a later commit are closed, while outstanding comments remain open. That reduces the housekeeping cost of rechecking already addressed items, but a resolved comment does not prove that the change is correct. People still need to inspect the diff, tests, and context, especially for security, migrations, and business rules.
For analysis, the review agent can use the full shell tools available through the Copilot SDK behind the Copilot agent firewall. It can run builds, tests, targeted scripts, and retrieve available tool or API information. The platform still determines the tool permissions, execution environment, and readable data. Not every repository automatically gets the same setup, and a passing test does not prove product correctness.
GitHub also says the Lite effort level now uses an ensemble of agents and combines their perspectives. In a GitHub experiment, the volume of addressed high-severity comments increased 47%, medium-severity comments 31%, and low-severity comments 11%, while review cost fell about 8%. These are GitHub’s own experimental results: useful directional evidence, not an independent benchmark that generalizes to every team.
The product shift is worth watching because the review agent is no longer only generating static observations. It is entering a loop of raising an issue, running verification, and updating state. Builds and tests can provide better evidence than model intuition, but test coverage is limited and a successful shell command is not the same as business correctness. Engineering teams still need to decide which checks an agent can complete automatically and which require approval.
Security and governance boundaries need to be designed at the same time. The Copilot agent firewall, tool allowlists, secret management, branch protection, required code-owner review, and reproducible commands should be part of the formal process. GitHub does not claim that the update covers every risk. Organizations should not treat agent tool access as equivalent to CI/CD or production access, and should not expose sensitive credentials for convenience.
Measurement after rollout should go beyond the number of automatically closed comments. More useful signals include false positives and false negatives, developer acceptance, resolution accuracy, review latency, runtime cost, regressions, and the rate at which humans reopen comments. If an ensemble improves coverage while using more compute, compare the cost per effective merge or high-value defect found instead of only the price of one call.
Overall, GitHub is embedding AI code review into the pull request state loop: an agent can make an observation, call controlled tools, wait for a later commit, and update its feedback. That can remove mechanical triage, but the engineering team still owns merge, release, and exception decisions. Results will depend on tool boundaries, test quality, human review, and traceability working together.
