September 17, 2026: GitHub rewrites Copilot runtime in Rust

Good day. It is September 17, 2026, and GitHub's most important fresh signal is technical rather than flashy. GitHub says the Copilot agent runtime used by the Copilot CLI, the Copilot app, and the Copilot SDK has been rewritten from TypeScript on Node.js and V8 into more than 800,000 lines of production Rust, with AI agents writing most of the code across 128 pull requests. That is a company claim, not an independently verified audit, but if it holds up, it matters because runtime language and architecture can shape latency, memory use, and long-term maintenance across the products that share that core. [source 1]

The second theme is control. GitHub says Copilot budget increase requests are now generally available for Business and Enterprise customers under usage-based billing. In plain language, this is the difference between a hard stop and a managed approval flow. Instead of an individual hitting a fixed credit ceiling and getting blocked, an admin can review a request and approve, adjust, or deny more budget in settings. That is a small workflow change on paper, but it is a meaningful one for enterprises trying to balance AI usage with spend controls. [source 2]

That same pattern shows up in identity and security. GitHub says enterprise admins can now automate SSO authorization for classic PATs and SSH keys across organizations in GitHub Enterprise Cloud, using enterprise-installed GitHub Apps to bulk-authorize up to 50 organizations per request. The practical effect is less manual friction for service accounts and automation, which also makes long-lived credentials less awkward to manage. GitHub also says SCIM user responses now include a standard profileUrl attribute, giving identity teams a direct GitHub account URL for linked external identities. That does not sound dramatic, but identity plumbing is the kind of thing that becomes expensive when it is messy, so even a small field can reduce join-up work between HR, identity, and developer tooling. [source 3, 4]

On the security side, GitHub says AI Scan for pull requests no longer requires CodeQL default setup, and the change is in public preview for organization-owned and personal repositories on github.com for GitHub Advanced Security customers. The important mechanic here is lower setup friction. If a security check is easier to turn on, it can appear earlier in more workflows, which is often more valuable than a fancier detector that people never configure. This is still a preview, so the open question is whether GitHub can keep that broader access without creating more noise for teams that already struggle with signal-to-noise in code review. [source 5]

There was also a short reliability thread that is now closed, at least for the moment. GitHub Status says the Copilot AI Model Providers incident affecting Gemini 3.8 Flash was resolved on September 16, and that a root cause analysis will be shared later. That means the specific outage is over, but the reliability question is not gone. The unresolved scorecard item to watch is whether this was an isolated degradation or part of a recurring pattern in Copilot model-provider availability. [source 6]

One useful way to think about the billing change is this: usage-based Copilot turns AI assistance into something closer to a meter than a seat alone. A team can still buy access, but once a user exhausts their allowance, the organization has a budget decision to make rather than a silent overage or a dead end. That is why the budget request workflow matters. It is the control valve behind the newer Copilot billing model, and it tells you GitHub is trying to make heavier use easier to approve without making it invisible. [source 2]

Stepping back, these updates point in one direction. GitHub is tightening the operating system around Copilot and enterprise administration at the same time it is rewriting part of the Copilot stack. That combination suggests attention to both scale and governance. The runtime rewrite is about the machinery. The budget, SSO, SCIM, and security changes are about making the machinery easier to buy, control, and audit. And the incident resolution reminds us that the model-provider layer still has to prove itself under real-world demand. [source 1, 2, 3, 4, 5, 6]

What to watch next is concrete. First, whether GitHub publishes the promised postmortem for the Gemini 3.8 Flash incident, and whether it points to provider-specific fragility or a broader Copilot dependency issue. Second, whether GitHub follows the Rust runtime announcement with any measurable latency, cost, or stability data. Third, whether the new budget-request workflow shows up alongside further Copilot billing controls, which would signal a broader move toward managed consumption. Fourth, whether the SSO and SCIM changes get mirrored in more enterprise admin surfaces, which would suggest GitHub is still smoothing the rough edges around identity and automation. [source 2, 3, 6]