Adding AI to the developer workflow is now the easy part. The harder part for engineering leaders is running it at scale: controlling cost, keeping metadata consistent, catching vulnerabilities early, seeing what developers use, and keeping code review useful rather than noisy.

GitHub’s mid-September releases address those operational questions. They span model selection, governance, security, analytics, and code review. Here is what changed in each area and why it matters.

1. Auto Model Selection Gets Efficiency, Balance, and Intelligence Tiers

Copilot’s Auto mode picks the best-fit model for each prompt, so developers don’t have to choose one manually. The update adds three tiers that let developers and teams decide how Auto weighs cost, quality, and response time:

• Efficiency favors speed and lower cost, which suits quick edits, boilerplate, and simple questions.
• Balance trades off quality and speed for everyday work.
• Intelligence prioritizes stronger reasoning for complex problems, such as tricky debugging, architectural questions, or multi-file changes.

Developers get sensible model routing without having to track every model release. Organizations get a direct lever on the trade-off between spend and output quality. A developer renaming a variable and one untangling a concurrency bug have different needs, and this setting lets both be served without one-size-fits-all defaults.

2. Copilot Suggests Allowed Values for Custom Properties

Custom properties are repository metadata: tags such as environment, data sensitivity, team ownership, or compliance tier. They make it possible to target rulesets and policies at the right repositories, but they only work if the values are consistent.

Anyone who has managed metadata at scale knows the failure mode. One team writes “prod,” another “production,” a third “Production.” Targeting rules then miss repositories, and audits turn into cleanup projects.

Copilot can now suggest allowed values when admins create a custom property. It helps them define a clean, sensible set of options upfront, such as production, internal, and confidential. That is a small feature, but it goes after a real source of governance drift at the moment the schema is designed.

3. AI Scan for Pull Requests No Longer Requires CodeQL Default Setup

Security scanning that is hard to enable tends to go unused. Previously, AI-powered scanning of pull requests depended on CodeQL default setup being in place. That prerequisite meant repositories not using that configuration were left out.

The dependency is gone. Once AI Scan is enabled, eligible repositories can get broader AI-powered vulnerability detection on pull requests without that separate setup. For security teams, this means:

• Wider coverage across repositories that were previously ineligible
• Less configuration work to roll out
• Earlier detection, because issues are flagged in the pull request, before code merges

This fits a familiar security principle: catching a vulnerability during review costs far less than fixing it in production. Removing friction from enabling that check moves more code under it.

4. Usage Metrics API Now Reports Agentic CLI Customizations

Developers increasingly extend Copilot’s command-line experience with skills, custom agents, MCP servers, slash commands, and plugins. This customization is powerful, but without telemetry it is also invisible to the people responsible for it.

The Copilot usage metrics API now reports these customizations, so admins can see which extensions developers actually use. That helps answer practical questions:

• Which custom agents or skills are being adopted, and which sit idle?
• Are approved MCP servers being used, or are developers working around them?
• Is the investment in internal tooling and plugins paying off?

Visibility supports both enablement and governance. Teams can promote what works, retire what doesn’t, and spot patterns that may warrant security or compliance review. As agentic workflows grow, knowing what is connected to your AI tooling becomes as important as knowing which tools you licensed.

5. Impact Dashboard Adds Feature Engagement Over a 28-Day Window

Buying licenses does not mean people are getting value from them. The Copilot impact dashboard now shows feature engagement across key Copilot experiences over a rolling 28-day window.

A rolling window smooths out one-off spikes and makes trends easier to read. Leaders can use it to find:

• Adoption patterns: which experiences are becoming habits
• Enablement gaps: teams or features with low engagement that may need training, documentation, or a nudge
• Opportunities to share practice: where one team’s usage is far ahead of another’s

Adoption data is most useful when it drives action. Paired with the customization metrics above, it gives a fuller picture of how AI tooling is really being used, not just whether it has been rolled out.

6. Code Review Improvements: Clearer Findings, Smarter Resolution, Better Commit Messages

Automated code review helps only if its output stays manageable. The updates here target three friction points:

• A clearer view of findings. Reviewers can see which findings are open, which are resolved, and which are newly discovered, so they don’t have to re-read the whole thread on every push.
• Smarter auto-resolution. Findings that have been addressed can be resolved automatically, which reduces stale comments cluttering the pull request.
• Generated commit messages for batched suggestions. When eligible suggestions are applied in batches, Copilot writes the commit message, removing a small but constant chore.

None of these is flashy, but together they make the review loop faster and less noisy. That matters most on busy pull requests, where signal-to-noise decides whether a review tool helps or gets ignored.

The Bigger Picture

Read individually, these are incremental improvements. Read together, they show a pattern:

Theme	What improved
Model choice	Tiered Auto selection for cost, quality, and speed
Governance	Consistent custom property values
Security	Broader AI-powered scanning on pull requests
Adoption	Customization metrics and a 28-day engagement view
Review quality	Clearer findings, smarter resolution, better commit messages

The industry conversation has often focused on what AI can generate. For organizations, the deciding questions are increasingly about operations: whether they can control it, measure it, secure it, and fit it into existing workflows without adding overhead. These updates address those questions.

What Teams Can Do Now

1. Review your Auto model settings. Decide which tier suits different teams and use cases.
2. Audit your custom properties. Use the suggestion feature to standardize values before governance rules depend on them.
3. Check AI Scan eligibility. Repositories that were blocked by the CodeQL prerequisite may now qualify.
4. Look at your usage metrics. Find out which agentic customizations are in use and whether they are sanctioned.
5. Use the impact dashboard in enablement planning. Let engagement data guide where you invest in training.
6. Revisit your review workflow. See whether the improved findings view and auto-resolution reduce review fatigue.

Final Thoughts

The most useful AI platforms will be the ones organizations can trust and manage, not only the ones that generate the most code. Model choice, governance, security, telemetry, and review quality are the kind of unglamorous features that decide whether AI development tooling can move from experiments to standard practice.

If you’re responsible for developer tooling, these updates are worth a look. The gap between “we have AI tools” and “we run AI tools well” is where much of the real work now lies.