GitHub Copilot lets AI approve tool requests. Is that safe?
GitHub Copilot Assisted Permissions reaches GA. An LLM assesses commands, files and URLs. Why convenient approvals still need strict technical limits.
GitHub Copilot Assisted Permissions became generally available on October 26, 2026. A model reviews eligible tool permission requests and automatically allows those it considers clearly safe. Other requests still require approval. The feature does not replace sandboxing or enterprise rules.
Facts and evidence limits
- Vendor statement
Documented release scope
GitHub Copilot Assisted Permissions became generally available on October 26, 2026. A model reviews eligible tool permission requests and automatically allows those it considers clearly safe. Other requests still require approval. The feature does not replace sandboxing or enterprise rules.
- Evidence gap
No independent efficacy audit
AgentenCode has not conducted its own security, cost or runtime tests.
What actually changes
Coding agents can spend a surprising amount of time asking whether they may run commands, read files or open websites. Granting everything up front removes the interruptions but creates a different risk for private data and production systems. GitHub introduced a middle route on October 26: Assisted Permissions is now generally available in Copilot CLI, the Copilot App and Visual Studio Code.
The mode uses a language model to assess eligible tool requests. Requests judged clearly safe can proceed without another prompt, while others still need human approval. GitHub cites commands, filesystem paths and URLs among the relevant operations. This is a permission-triage mechanism, not a promise that the generated code is accurate or business-safe.
Users can select the mode through /permissions in Copilot CLI, through Tool Permissions in the Copilot App, or through the permissions picker in VS Code. Enterprise administrators can prohibit Allow All, allow or disable Assisted, and determine default settings. Central restrictions remain important because a personal preference should not weaken a production security policy.
Limits and a practical test
Unattended agents expose another boundary. GitHub documents that when a request still needs human approval during a non-interactive session, it is denied rather than silently granted. The agent can attempt a different method. That is a sensible fallback but does not establish that the LLM assessor will catch every dangerous command or indirect execution chain.
Assisted Permissions must not be confused with GitHub's already generally available local sandbox. Sandboxing technically restricts the filesystem, network and other capabilities of executed tools. Assisted Permissions evaluates whether the tool request should be authorized. The layers address different questions and can complement one another; neither makes the other redundant.
A command can look harmless before it downloads another script, follows a path to sensitive data or invokes a connected MCP tool with broader privileges. A model-based decision is not formal verification. We would evaluate ordinary read-only work, deliberately prohibited network operations and destructive writes in an isolated test repository, tracking false approvals as carefully as reduced prompts.
AgentenCode's Agent Finder helps compare coding-agent options, Agent Fit frames practical deployment needs, and Agent Check documents permissions, evidence gaps and exceptions claim by claim. Those resources are editorial decision aids, not a security certification. AgentenCode has not independently measured the new feature's false-approval rate.
Our view
Our view: A model reviewing routine prompts is a better compromise than constant interruptions or unrestricted access. It may improve ordinary development work. But model judgment must not be the final control for secrets, destructive commands and production deployments. Hard deny policies, actual runtime isolation and human authorization remain essential.
Sources and scope
Original-source journalism with independent editorial opinion, not an asserted practical test or certification.
Frequently asked questions
Is Assisted Permissions generally available?
Yes. GitHub announced GA on October 26, 2026 for Copilot CLI, Copilot App and VS Code.
Does the AI now approve every command?
No. Only eligible requests judged clearly safe can proceed automatically. Others still need approval.
Does it replace local sandboxing?
No. Sandboxing enforces technical boundaries; Assisted Permissions assesses authorization requests.