This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — On 21 August 2026, GitHub released public-preview Copilot cloud-agent integrations for Slack and Microsoft Teams. A user can mention @GitHub in a message, channel, or thread to ask questions, investigate failures, plan or implement changes, create issues, and open pull requests. The agent works asynchronously in a GitHub-hosted cloud sandbox while participants follow and refine the work from the conversation.
THE IDENTITY BOUNDARY — GitHub documents two different authorization paths. In a direct message, Copilot acts using the linked user’s GitHub permissions. In a shared channel or thread, generated artifacts use the Copilot app identity; only a user with repository write access can trigger code changes, while permitted participants can contribute context. GitHub also warns that the entire thread becomes context and that this context is stored in the artifacts the agent generates. Conversation membership, repository access, and app installation scope now meet at one boundary.
WHY IT MATTERS — Chat was once mostly discussion around the software supply chain. It can now initiate work inside it. A mistaken default repository, an overbroad app installation, an ambiguous thread, or a compromised collaboration account may influence what the agent investigates and proposes. Existing repository permissions still apply, and the agent opens a pull request rather than silently merging code, but those controls only protect the organization when they are configured and reviewers inspect the resulting change.
FRACTAL INFERENCE — One casual sentence can become task context; many sentences become a plan; the plan becomes a diff; the diff can become production. Small assumptions repeat across that chain: which repository was meant, whose instruction has authority, whether quoted text is data or direction, and whether a passing test proves the change is safe. This is an inference about workflow risk—not evidence that the new integrations bypass GitHub permissions or that a published attack has occurred.
WHAT TO CHECK — Enable the integrations only for intended organizations and repositories; review the GitHub app’s installation scope; verify linked accounts, channel membership, default repositories, and write access; keep protected branches and required reviews; and use GitHub’s additional approval for Copilot-attributed pull requests. Do not place secrets or sensitive incident details in threads that may become retained agent context. Inspect the conversation link, diff, tests, model and repository before approval. Editorial view: a sandbox limits execution, but human review limits authority—both are needed when conversation becomes code.