GitHub Copilot October 2026 Updates Add Sandboxing and Review API

A month spent on control, not on smarter answers

October 2026 was a busy month for AI coding assistants. Less of the work went into smarter code suggestions and more went into the controls needed to run autonomous agents safely, track what they do, and pay for them. GitHub shipped Copilot updates almost every day. Anthropic released Claude Code builds about as often. Cursor kept turning its editor into a place to manage fleets of agents. Taken together, the release notes show the three companies converging on the same problems: sandboxing, permissions, usage reporting, and code review.

One analysis of the month described Claude Code, Codex CLI, OpenCode and VS Code all shipping meaningful agent updates between October 12 and 16. It said each was aimed at letting developers run more autonomous agents with less supervision.33 That reading fits the wider record. This month's releases dealt with plumbing more than intelligence.

GitHub Copilot: sandboxes, models and admin controls

GitHub's most important change was local sandboxing, which became generally available. It lets developers restrict what agents can reach in terms of files, network access and credentials. It works in Copilot CLI, the Copilot app, and VS Code sessions that use Agent Host, and it costs nothing extra.1 Copilot CLI itself moved through roughly a dozen releases in October. They covered sandbox support on Windows, real-time sandboxing for all users, and detection of possible secrets so users can mask them before saving.5 A late-month CLI build made Improved Assisted Permissions available without turning on experimental mode.2

The model lineup changed quickly too. Claude Haiku 5.5 reached Copilot Pro, Pro+, Max, Business and Enterprise users in the first week of the month.1 Google's Gemini 4 Argon became generally available on October 13.7 GitHub retired a set of models on October 19, announced another round of deprecations for November 16,37 and expanded HydraFusion, its multi-model orchestration option, with a new Max tier.7 Computer use, which lets Copilot operate desktop applications, entered public preview in the CLI and in the Copilot app on macOS and Windows.10

Much of the month's work targeted administrators rather than developers. A global default policy for generally available Copilot features is being enforced in stages through October 26 on Business and Enterprise plans. Settings that were never configured now take the global default, while explicit choices stay as they were.6 The usage metrics API now records traffic from third-party clients such as OpenCode,2 and it lists the names of custom skills, agents, MCP servers and plugins that organizations have built.2 The impact dashboard gained an opt-in comparison against industry peers.6 JetBrains users got enterprise-managed default models and a setting that stops MCP servers from starting automatically.4 GitHub's message to buyers is clear: it is selling Copilot as something enterprises can govern, not just a better autocomplete.

Claude Code: high release volume, focused on security

Anthropic's pace was faster still. Claude Code went from version 2.1.227 to 2.1.305 between August 10 and October 20, a span of 66 versions.35 By October 23 it had reached 2.1.310.31 Tracker summaries describe many of these as large batches of fixes, some with close to 190 items, and many of the fixes closed sandbox and permission gaps.37 The week ending October 25 was mostly security work. Version 2.1.309 included more than ten fixes for ways to get around the sandbox and the permission checks.40 Version 2.1.307 added a claude_code.safety_event telemetry event that records each time a rule, a hook, auto mode or the sandbox steps in on a tool call.36

Anthropic also opened Claude Code to more extension. Claude Mods arrived on October 1 in version 2.1.287, letting plugins hook more deeply into the tool's behavior.36 Version 2.1.292 added marketplace-based plugin installs and an effort setting for subagents.31 Version 2.1.302 turned forked subagents on by default beyond the terminal.36 Reports disagree slightly on that release's date. Changelog trackers give October 16,3336 while another report dates it to October 17 based on when Releasebot logged it.34 That is likely the gap between when the release was published and when a tracker picked it up, so the difference does not matter much.

There are also changes that could catch teams out after upgrading. Interactive sessions now start in auto mode. Headless claude -p runs and the Agent SDK start in Manual mode. The default model on Pro and Team Standard plans has moved from Sonnet to Opus.35 Any team that pinned model behavior or depends on unattended scripts should review its settings.

Cursor: from editor to agent manager

Cursor spent October building out its agent platform. On October 6 it shipped Remote Control, which lets developers watch and reply to local agents from the iOS app. The feature is on by default for everyone except Enterprise organizations.12 The Origin App Marketplace launched on October 13 with more than 20 integrations, including Cloudflare and Linear.1320 On October 16, cloud agents gained interactive canvases and a beta Environments API. Environments can now hold up to 300 repositories, and large ones load five times faster.1112 These build on Projects, a beta feature in which a coordinator agent hands work out to thousands of subagents and can react to Slack messages, pull requests or a schedule.12

Pricing is less clear. One report says Cursor moved new subscriptions on October 12 to The X Subscription, with Plus, Premium, Super and Ultra tiers and weekly usage resets. Under that report, Claude, GPT and Gemini usage on higher tiers is billed at API list price from prepaid credit.17 A separate guide from early October still lists Pro at $20 a month.16 Only one tracker reports the overhaul, so buyers should check current terms before committing. Market-share figures also suggest Cursor's position is under pressure. One comparison puts its usage share at 14.9% in 2026, down from 17.9% in 2025, against VS Code's 70.9%.19

Code review is now the main contest

The most clearly competitive area this month was AI code review. On October 2, GitHub made Copilot code review available through the REST and GraphQL APIs, with a review effort level that can be set per request. Balanced is now the default effort level.9 Organization owners also got the option to bill members' reviews to the organization.10 Separately, GitHub made AI Scan for pull requests generally available. It looks for vulnerabilities in languages and frameworks that CodeQL does not yet cover.7

Anthropic made Claude Code Review generally available on October 15,35 for Team and Enterprise customers.22 Claude Code version 2.1.304 added review levels that can be set per repository.36 One comparison lists Quick, Standard and Deep levels for Claude's service and says it never approves or blocks a pull request. It contrasts that with Copilot's opt-in approval preview.22 Cursor's answer is Bugbot, which works with GitHub, GitLab, Bitbucket and Azure DevOps.22 One hands-on comparison in October ranked Bugbot first for catching high-severity bugs, with Codex close behind.22

Cost is where the reporting matters most. Several sources agree that since June 1 each Copilot review uses AI credits, plus Actions minutes on hosted runners. GitHub estimates $0.05 to $1 per review at Lite and $0.25 to $5 at Balanced.242527 That makes the switch to a Balanced default effectively a price increase for teams that never changed the setting. Some guides still describe Copilot review as included in a flat $10 plan with no extra usage charges, which looks out of date.26 Sources also disagree on how the reviewer works. Some call it agentic, gathering context from the whole project,2123 while another calls it diff-based and limited to a single repository.29 Both can be true: the agent gathers context within the repository but does not read across repositories.

On quality, Copilot holds up well. On Martian's Code Review Bench it ranks fourth of 14 tools with a 61.0% F1 score, within about a point of Greptile, CodeRabbit and Claude.27 That ranking comes from a blog run by a competitor, though the figures are taken from the public tracker.27

Analysis: what to take from October

The main point is that the competitive advantage has shifted. Every major tool now offers frontier models from Anthropic, OpenAI and Google, often within days of their release.1722 What separates the tools now is how well they govern agents: sandbox reliability, permission rules that fail closed, telemetry that administrators can audit, and review costs that can be predicted. GitHub benefits from distribution and admin tooling. Anthropic is moving fast, and its long list of security fixes shows how much there is to fix. Cursor is betting on large-scale agent orchestration while its pricing is in flux. Engineering leaders should check sandbox defaults and review-effort settings before rolling these tools out widely, rather than relying on model benchmarks.