Summary: On October 22, 2026, GitHub shipped a changelog roundup of September’s Copilot updates for Visual Studio 2026. Three changes stand out: the Git agent can now explore a pull request from inside Copilot Chat, Bring Your Own Model (BYOM) moved behind a new Agent (Preview) harness, and NuGet audit warnings gained a one-click Copilot fixer. Each one quietly changes how .NET developers wire AI into their daily loop.
Reviewing PRs without leaving chat
The most immediately useful item is the Git agent. You attach a pull request as context from the Git Repository window, and it returns a summary with navigable links to the underlying comments and files. Two prerequisites matter if you’re planning to roll this out: you need to connect your Git provider’s MCP servers, and both GitHub and Azure DevOps are supported.
This fits a pattern I’ve written about before — the value isn’t the summary itself, it’s the review loop of summary, links, and context in one place, which I looked at in Copilot’s diff, terminal, and browser panels. The IDE is catching up to what the standalone Copilot app already does.
BYOM gets a breaking change
BYOM is now on by default across Community, Professional, and Enterprise editions, and it works whether or not you’re signed in to GitHub. Supported providers include Microsoft Foundry, OpenAI, Anthropic, and Ollama.
Here’s the part that will break someone’s setup on update day: BYOM now requires the new Agent (Preview), which runs on a harness built on the GitHub Copilot SDK. The old Ask and Agent modes no longer support BYOM, and previously configured Ollama models need to be re-added after updating. If your team relies on local models through Ollama, budget time for reconfiguration rather than assuming the update is transparent.
It’s also worth noting how this compares to the JetBrains side, where model choice has been trending toward admin-managed defaults — I covered that in Copilot for JetBrains tightening its enterprise model controls. Visual Studio is moving the opposite direction: more model freedom for individuals, but constrained to a specific harness.
NuGet vulnerabilities become fixable actions
The third change turns a passive warning into an active workflow. NuGet Audit warnings in the Error List now include a fixer action that opens Copilot Chat in agent mode and asks it to fix the vulnerable packages through the NuGet MCP server. You need to be signed in to Copilot and enable the NuGet MCP server from the tools menu.
The design here is what makes it practical: the fix prompt appears exactly where the warning already lives. No context switching, no copy-pasting a CVE into a chat window. Supply-chain fixes becoming a one-click agent task is a small change with a real security payoff.
What this means for your setup
All of these features ship to every Copilot plan, including Free, Student, Pro, Pro+, Max, Business, and Enterprise, and you’ll want the Insiders channel for the latest builds. The practical takeaway: if BYOM is part of your workflow, plan the migration to the Agent (Preview) harness before the old modes disappear from your muscle memory, and switch on the NuGet MCP server — it’s the cheapest security upgrade in this release.
Sources
View the original post on X