Copilot Fusion picks and combines AI models for you as agents flood GitHub with 7.4 billion commits

GitHub Copilot no longer needs you to pick the AI model behind each job. At Universe 2026, its annual conference in San Francisco on October 28 and 29, GitHub announced that Copilot Fusion is generally available. Fusion decides, task by task, whether one model is enough or several should work on it, balancing quality, speed and cost. Until now, Copilot users chose from a list of models by OpenAI, Anthropic and Google, or let Auto mode pick one per request.

Fusion arrives with three additions to the Copilot app, a search service built for agents, three security features and a large infrastructure expansion. Behind all of it is a jump in activity. GitHub recorded 7.4 billion commits in September, five times as many as in September 2025. A commit is a saved set of changes in a project's history (our GitHub beginner's guide covers the basics). GitHub attributes the surge to demand from AI agents, software that takes an assignment and carries it out step by step.

How Fusion picks its models

You set Fusion to one of three levels, Standard, High or Max, depending on how much effort a task needs. Copilot weighs how much reasoning, code generation, debugging and tool use the job needs, then decides whether one model handles it or several share it. Since September 30, GitHub has been testing a similar idea, HydraFusion, in which a fast model drafted a solution and a stronger one reviewed or redid it if it failed a quality check. GitHub has not said whether Fusion grew out of it.

GitHub says Fusion Max scores within two points of Anthropic's Opus 5.5 Max on the Artificial Analysis Coding Agent Index, a ranking of how well AI agents complete programming tasks. By the same figures, it gets there at half the cost and with 40% less time per task, nearly the same result for half the credits. GitHub has not said which Copilot plans include Fusion or how many credits each tier uses.

If that holds, the savings show up on the bill because Copilot moved to usage-based billing on June 1. Every plan includes a pool of AI credits, and each model draws them down at its own rate for the text it reads and writes.

Projects, connectors and search for agents

The Copilot desktop app, which can already operate other apps on your computer, gets three additions. Copilot Projects is a persistent space that survives the end of a session. It keeps goals, context, sessions and results together, so you can run several tasks in parallel and track them from one place instead of opening a fresh chat each morning and explaining everything again. It is available in the app starting today and can spread agent work across several repositories at once.

Copilot Connectors makes it simpler to plug Copilot into MCP servers such as those from Vercel, Cloudflare and Sentry. MCP is an open standard that lets an AI query outside tools, so Copilot could, for example, read the errors Sentry has logged for your app without any copying and pasting. GitHub does not say which setup steps it removes, only that Connectors will work across the app, the CLI, VS Code and Copilot code review. Before linking an account, it is worth checking what access you give an agent.

Copilot Automations saves reusable agent tasks so work keeps moving without repeating the request, with controls over where they run, what they can do and how much they can spend. They run in the cloud and can start manually, on a repository event or on a schedule. GitHub adds that they can learn from outcomes and propose improvements, which someone reviews before they apply.

Outside the app, GitHub agentic search looks across agent sessions, code, issues, pull requests (proposed changes that someone reviews before accepting), reviews and commits. It is read-only and subject to governance controls set by the organization. It returns action plans, and GitHub pitches it as a way to avoid duplicated effort. If another agent has already investigated a similar bug, a new task can start from that work.

Copilot access is also extending to every GitHub Enterprise user, and admins can decide who uses it without buying extra licenses. Until now, each seat needed a license such as Copilot Business, at $19 per user per month with $19 in credits included. Under the new setup, companies pay only for the AI credits they use. It is available through GitHub's sales team now, with self-serve sign-up coming later, and existing Copilot Business and Enterprise customers can keep their plans or switch when ready.

Three security features for code and dependencies

AI Scans reviews every pull request for vulnerabilities in languages that GitHub's rule-based analysis does not cover, and it also scans code that was already merged. That rule-based engine is CodeQL, which turns a codebase into a database and runs queries describing known flaws. It supports Python, JavaScript, Java and Rust, among others, but not PHP, the language WordPress is built on. An AI model can read code without anyone first writing rules for that language. GitHub has not said how many false alarms the scans produce.

Reachability analysis tackles alert overload. Many alerts flag a vulnerable function inside a library that your project installs but never calls. The new feature shows whether your code actually reaches that function and displays the call path that gets there, so a team can verify it in GitHub and fix what is exposed first.

Package firewall checks each npm package, the main registry for JavaScript libraries, against company policy before it is installed. It blocks known malware and critical vulnerabilities before they reach the build. It lands almost three months after the attack on Keyv and related libraries. On August 4, tampered versions of at least 444 packages with more than 2 billion combined monthly installs appeared on npm, and running npm install was enough for a script to steal npm and GitHub tokens or AWS credentials. A pre-install filter can stop that kind of attack, provided the package has already been flagged as malicious when someone tries to install it.

Why GitHub is rebuilding its infrastructure

The least flashy part of the announcement responds to a year of outages. On August 17, the platform spent 7 hours and 47 minutes with failures across the website, sign-in, Actions, pull requests and Copilot. Its CTO later explained that a component in its Central US data center failed to scale during a traffic peak, and that monthly commit volume had doubled since April. February and April had already logged seven major incidents each, according to IncidentHub's tracker.

To absorb September's 7.4 billion commits, GitHub says it is adding 4 million CPU cores, 160 petabytes of high-speed storage, 50 terabits per second of network capacity and more capacity for Actions, the service that runs automated jobs such as test suites. It is also moving the platform to a multi-region setup on Microsoft's Azure cloud, a migration it expects to finish early next year.

The deeper change is in Git, the system that stores each repository's history. GitHub is separating compute, the machines that handle each request, from the storage where data lives, so each can grow independently. The company says that will deliver 35 times the performance, without specifying for which operations, and practically unlimited read capacity. A read happens every time a person or an agent pulls a repository down to work on it.

GitHub's main announcement gives no prices or dates for Connectors, agentic search or the three security features.