We've kept GitHub Copilot installed for close to a year. It's no longer the tool we reach for first on hard problems, but it's the one we fall back on for something simple and predictable — and that split is the honest summary of where it sits today.
What actually holds up
Inline completions are still best-in-class for latency — ghost text appears almost instantly, even on large files. Zero switching cost: install the extension, sign in, code. And editor breadth is a real advantage — first-class support across VS Code, JetBrains, Neovim, and Visual Studio means the whole team can use it regardless of editor preference.
Where it falls behind
We ran a direct test: asked Copilot's @workspace agent "how does our error handling strategy work across the API layer?" It found the main error handler middleware but missed our custom error classes, the React error boundary, and the Sentry integration. We asked Cursor the same question and it answered comprehensively on the first try. Copilot works from open files and nearby context, not a deep model of the whole project — that gap is the main reason people move to Cursor or Claude Code for anything beyond autocomplete.
Multi-file editing (Copilot Edits) is similarly inconsistent compared to Cursor's Composer — we don't trust it without careful review beyond simple renames.
Pricing, as the page currently states it
Individual is $10/month ($100/year) — still the cheapest paid AI coding tool on the market for straightforward autocomplete-plus-chat. Business is $19/seat/month (admin controls, audit logs, IP indemnification — genuinely well implemented). Enterprise is $39/seat/month, adding fine-tuned models on your org's code.
One thing our review doesn't cover — and the record on it just got corrected
A story broke this month that's directly relevant to anyone weighing Copilot's security tooling, and it's worth knowing even though it isn't in our review yet.
Security firm Wiz ran an autonomous AI red-team tool ("Red Agent") against a public Snowflake repository through Snowflake's HackerOne program. It found a script-injection flaw in a GitHub Actions workflow (a crafted GitHub issue title got expanded directly into a shell command instead of being passed through an env variable — a known GitHub Actions anti-pattern) and used it to exfiltrate Jira credentials, briefly reaching Snowflake's internal Jira. Wiz reported it June 23, 2026; Snowflake patched it the same day and says it found no evidence of unauthorized access beyond the token exposure.
The initial framing — widely picked up, including by The Register — was that GitHub Copilot Autofix wrote the vulnerable code. GitHub disputed that: the vulnerable workflow logic traces to a human Snowflake engineer's commit from August 2025, and Autofix's "co-author" tag was attached later, during a June 18, 2026 PR merge that squashed several commits together. On August 17, Wiz updated its own writeup to clarify: Copilot Autofix's actual role was reviewing that merged PR and marking it clean — it missed the vulnerability rather than introducing it.
That's a meaningfully different (and less flashy) story than the initial headline, and it's the more useful one: an AI code-review layer gave a false all-clear on a real, exploitable flaw. If you're leaning on Copilot Autofix as a security backstop, treat a clean pass as "nothing obvious," not as an audit.
We haven't added this to the review yet — flagging it here rather than overstating what the current page covers.
Disclosure: we have no confirmed affiliate or commission relationship with GitHub for Copilot.
Full review — pricing breakdown, the Cursor comparison, and where Copilot still wins: https://devtoolsreview.com/reviews/copilot-review/
Top comments (0)