Overview
GitHub Copilot autocompletes your code. Type a comment describing what you want, and it writes the function. Start a line, and it finishes the thought. It works across dozens of languages and integrates directly into VS Code, JetBrains, Neovim, and other editors.
As of mid-2026, Microsoft sells four individual tiers: Free, Pro at $10 a month, Pro+ at $39, and Max at $100, alongside Business at $19 a seat and Enterprise at $39 a seat for teams. GitHub moved every plan onto usage-based AI Credits billing in June 2026, so a heavy month of agent use can cost more than the flat subscription price implies.
The technology is built on OpenAI’s Codex models, trained on billions of lines of public code from GitHub repositories. This is the part that gets awkward: Microsoft owns GitHub, which hosts the code, and Microsoft invested $13 billion in OpenAI, which trained on that code. The developers who wrote it were never asked and receive no compensation.
A class-action lawsuit filed in 2022 challenged this. A federal judge dismissed all but two of the original claims in January 2024, and the case is now on appeal to the Ninth Circuit over a narrow DMCA question: whether stripping copyright notices from AI-suggested code requires an identical copy to count as a violation. Oral arguments were held in February 2026, plaintiffs are seeking roughly $9 billion in statutory damages, and no ruling has landed. Copilot remains one of the fastest-growing products in Microsoft’s history regardless.
What It Knows About You
Copilot sees your code. All of it. Every file open in your editor, your repository structure, your commit messages, your comments.
Since April 24, 2026, GitHub uses interaction data (your prompts, your code, and Copilot’s outputs) to train its AI models by default on the Free, Pro, and Pro+ plans, the tiers most individual developers are on. That is a reversal: before that date, the same data required opt-in consent. You can turn it off in Settings without losing any functionality, but the tool now assumes yes unless you go find the switch. Business and Enterprise plans stay excluded under their contracts, and private repository content sitting at rest is not used for training either way.
The telemetry beyond training is extensive too. Microsoft tracks which suggestions you accept, which you reject, how long you pause before accepting, and what you edit afterward. It knows your coding patterns better than you do.
If you’re on an individual plan without the right settings and you’re working on proprietary software, you’re feeding trade secrets into Microsoft’s training pipeline. Many companies ban Copilot on individual accounts for exactly this reason.
The Real Risks
Intellectual property is the central concern. Copilot occasionally reproduces substantial chunks of existing code verbatim, including code under GPL, AGPL, or other copyleft licenses. Paste that into a proprietary project and you may have a legal problem. Microsoft added a filter to block exact matches, but near-matches slip through, and the underlying licensing question still sits unresolved with a federal appeals court.
Job threat keeps getting worse, not stabilizing. Junior developers feel this most. Entry-level developer job postings were down 67 percent from 2022 levels as of mid-2026, and workers aged 22 to 25 lost roughly a fifth of their positions since ChatGPT launched. Tech layoffs topped 52,000 in the first quarter of 2026 alone, with AI named as the explicit cause for about a quarter of them. A few large employers, IBM among them, have started rebuilding junior roles around reviewing AI output rather than writing routine code, but that is the exception industry-wide, not the norm.
Autonomy has thinned as Copilot’s agents took on more of the loop. Through 2026 GitHub added a cloud agent that runs on a schedule or in response to repository events without anyone triggering it, a Plan agent that drafts an implementation plan before code is written, and a Debugger agent that checks its own fixes against live runtime behavior. Each is opt-in at the feature level, but the direction is consistent: less of the coding loop requires a developer’s judgment before a change ships.
Security vulnerabilities are a real problem. Stanford researchers found that developers using AI code assistants produce less secure code and feel more confident about it. Copilot suggests SQL injection vulnerabilities, hardcoded credentials, and insecure cryptographic patterns. It doesn’t know what’s dangerous. It knows what’s common, and common code is often bad code.
Skill atrophy is measurable. Programmers who rely on Copilot for six months show a decreased ability to solve problems without it. The tool is a cognitive crutch, useful for output today and a real cost to the profession over time.
Alternatives
- Codeium / Cody (Sourcegraph): Free or cheaper alternatives with similar functionality and sometimes better privacy policies.
- Continue.dev: Open-source code assistant that works with local models. Your code never leaves your machine.
- TabNine: Offers a local model option that runs entirely on-device.
- Reading documentation: Slower. More reliable. Builds actual understanding.
Our Verdict
Copilot holds at a C, not because it’s safe, but because the risks are still manageable if you configure it correctly. Use the Business plan, disable telemetry, enable the license filter, and review every suggestion before accepting.
That advice matters more than it did in March. As of April 2026, individual plans train on your data by default, so opting out is no longer a formality, it is the only way to keep your prompts out of Microsoft’s training set. The job displacement concern is serious and broader than one product, and 2026’s hiring numbers show it worsening rather than leveling off. The IP dispute is real and now sits with a federal appeals court, unresolved. The growing stack of agentic features, a cloud agent that acts on a schedule and a debugger that grades its own work, adds a genuine autonomy question: convenient today, worth watching as less of the loop stays in human hands. It remains a powerful tool with real tradeoffs. Just don’t mistake autocomplete for understanding.