On 28–29 October 2026, GitHub laid out its vision of an agentic software delivery system at Universe: Markdown workflows compiled into Actions, dependency lockfiles, multi-cloud compute and model orchestration. The structural shift is the security model — agents read-only by default, safe outputs and built-in threat detection.
On October 28, 2026, at GitHub Universe, GitHub made Copilot Fusion generally available, a system that picks and orchestrates coding models on the developer’s behalf. For DevOps teams, the question is no longer which model to choose, but how to lock down the enterprise policy that governs the delegation.
On July 28, 2026, researcher Håkon Måløy published the first public demonstration of a document-borne AI worm capable of silently altering financial reports and self-propagating through Microsoft Copilot for Word. After 144 days of coordinated disclosure and two attempted fixes — including a model upgrade to GPT-5.6 — the vulnerability class remains exploitable.
