GitHub ships ten Copilot features at once. That's the story.
Issue #071 · 4 min read
GitHub ships ten Copilot features at once. That's the story.
Plus GitLab's new vulnerability finder and why your OpenAI robots.txt file matters now
The big story
Linus Torvalds just said the Linux kernel has moved past its "stabilization phase" for AI-written code and is now running on a "much healthier model" for AI contributions — that's The Register.
There's a catch buried in the headline.
Machine-made patches, Torvalds says, "often get rewritten."
Sit with that for a second. The project that invented open-source code review at scale is not rejecting AI contributions. It's accepting them and then rewriting them anyway.
That's not a ringing endorsement of AI coding quality. It's a description of what good review looks like when the thing being reviewed can produce plausible-looking code fast and wrong just as fast.
For a PM, this is the clearest real-world data point yet on what "AI wrote this" actually means for a mature codebase: not autonomy, not even much time saved on the review side, just a different kind of input that still needs a human to finish the job. If your roadmap assumes AI contributions mean less review work, the kernel's experience says otherwise.
What shipped
GitHub pushed out a wall of Copilot features at Universe, and the one PMs should actually look at is Copilot Fusion — now generally available, it routes and orchestrates which model handles a task instead of making you pick one upfront (GitHub changelog).
Alongside it: a standalone Copilot app that spans multiple repos and sessions, a security extension for triaging code-scanning alerts without leaving the app, shared "Copilot Automations" for team workflows, and Copilot now bundled free into GitHub Enterprise licenses (GitHub).
That bundling change is the quiet one worth flagging to finance — if you were budgeting Copilot as a separate line item, check whether your Enterprise contract just absorbed it.
GitLab Orbit is now generally available, and it's aimed at a real cost problem: GitLab says the expense of an AI code-review agent isn't the tokens, it's the agent approving a diff with no idea what pipeline ran it or who owns the service it touches — what GitLab calls "artificial confidence, not artificial intelligence" (GitLab). A companion feature maps where a vulnerable component actually lives and who's responsible for it, instead of security teams piecing that together from scanner output and a Slack thread (GitLab). If your AI reviewer has been rubber-stamping merges, this is the fix framed as a product, not just a feature note.
OpenAI will now honor a shared robots.txt signal for AI training preferences — publishers get one standard way to opt in or out across participating providers, instead of writing bespoke rules for each one (OpenAI). If your product ingests or publishes content, this is the kind of plumbing change that quietly becomes a compliance checklist item in six months. Worth reading now rather than when legal asks about it.
What I'd actually do this week
- Pull up your GitHub Enterprise contract and confirm whether Copilot access is now included — if it is, that's a renewal conversation worth having before your vendor has it with you.
- If you run an AI code-review agent in your pipeline, ask it one question: can it see the merge request history and ownership data, or just the diff? GitLab's framing of "artificial confidence" is a useful gut-check regardless of which tool you use.
- Check your site's robots.txt against what OpenAI now honors. If you've been ignoring AI-crawler policy because it felt unsettled, this is the first sign a standard is forming.
Hit reply if you've already moved review responsibility onto an AI agent and found the gap GitLab is describing — I'd like to hear what broke.