GitHub Agentic Workflows 0.91.8 adds traces, routing and hardening

What changed in this release?

GitHub's October 12, 2026 weekly update summarizes five versions of its Agentic Workflows project, from v0.91.4 through v0.91.8. The project supports declarative automation of agentic workflows in GitHub repositories. The release notes describe changes that matter to teams operating such workflows: more consistent execution evidence, improved model selection diagnostics and tighter runtime safeguards. These are project-scoped features, not a general announcement about every GitHub Copilot subscription.

Version 0.91.8 presents agent sessions as full elapsed-time timelines and normalizes traces across Copilot, Codex, Claude, Gemini, Pi, Kiro, Aider and AGY. A common timeline can help developers investigate failed steps across differing engines. It does not imply that all providers share identical agent capabilities, logs, access controls or data-protection characteristics.

Graders, model routing and security

The release introduces a built-in code-read-precision trajectory grader and can load grader defaults from setup-action JSON. For Copilot model routing, Agentic Workflows metadata now determines which wire APIs are selected, and the system exposes model mismatches. This provides clearer evidence when a configured model differs from the one that actually gets routed into an execution.

GitHub also describes closing a sandbox escape affecting custom graders and tightening workflow YAML handling, scanner file processing and temporary-file writes. Such fixes are worth reviewing when maintaining a deployed agentic workflow. However, a vendor release note does not prove that every sandbox, prompt-injection or supply-chain risk has been removed; teams still need project-specific testing and least-privilege configurations.

Upgrade considerations

Some intermediate releases carry migration implications. Version 0.91.7 adds a native Go AGY engine while deprecating the Gemini engine in its favor. Version 0.91.6 changes Git-backed work queues and extends model routing across multiple engines. Before upgrading, administrators should compare their engine settings, token scopes, workflow definitions, test results and compatibility requirements with the current project documentation.

AgentenCode treats this as an update to a particular open-source workflow system. Our related GitHub Copilot Coding Agent profile supplies ecosystem context only: its cloud agent features do not automatically inherit every gh-aw capability. This report follows GitHub's primary-source update rather than an independent benchmark or an independently verified security assessment.

Frequently asked questions

Is gh-aw v0.91.8 the same as GitHub Copilot Coding Agent?

No. GitHub Agentic Workflows is a specific open-source workflow project. Its release notes do not establish feature parity with other Copilot products.

Which security change stands out?

GitHub reports fixing a custom-grader sandbox escape, alongside tighter handling for workflow YAML, scanner files and temporary file writes.