GitHub Copilot Usage Metrics Adds Agent-App Activity
Teams can now separate third-party agent activity such as Claude and Codex in usage reports.
Key takeaways
GitHub announced on August 7, 2026 that the Copilot Usage Metrics API now reports activity from third-party agent apps. Enterprise, organization, enterprise-user, and organization-user reports can expose the activity in one-day and 28-day windows. The new totals_by_3rd_party_agent data includes a stable agent_id and a display name that may change; the identifier should be the join key. This gives administrators a finer view of cost, permissions, and workflow adoption, but it does not automatically explain business value. Start with a read-only sample, reconcile time zones, pagination, and overlapping windows, then associate agent activity with AI credits, members, repositories, and permission changes before changing budgets or access.
# GitHub Copilot Usage Metrics Adds Agent-App Activity
August 9, 2026
On this page
- Direct answer
- Fact sources
- Action guide
- Why it matters
- Impact
- FAQ
- Sources
Direct answer
Use agent_id as the stable key, keep one-day and 28-day windows separate, and reconcile pagination and time zones before connecting agent activity to credits, members, repositories, or permission changes.
Fact sources
GitHub's August 7 changelog adds third-party agent-app activity to Usage Metrics API reports.
The reports cover enterprise, organization, enterprise-user, and organization-user scopes in one-day and 28-day windows.
agent_id is the stable join key; an agent's display name can change.
Five steps to audit agent-app usage
- Confirm token permissions, API version, and report scope with a small sample.
- Store agent_id as the key and keep the display name for presentation.
- Pull one-day and 28-day windows separately; check pagination and time zones.
- Join activity to credits, members, repositories, and permission changes.
- Observe one read-only cycle before adding budget, limit, or disable actions.
Why it matters
As multiple agents enter GitHub workflows, total Copilot usage can hide tool-specific cost and access risk. Stable identifiers and explicit windows make the data auditable.
Impact for ordinary AI users
Teams can explain Claude or Codex activity more precisely, but metrics are not a complete measure of value. Wrong joins, time zones, and permissions can still mislead.
Related tools and tutorials
Account services can support access and quota governance; software and skill-learning pages can support API, logging, and review workflows.
AI software and tool entry points · AI account permissions and cost services · AI skill tutorials and validation methods · AI frontier news overview
FAQ
Why not key on agent_name?
GitHub says display names can change; agent_id is the stable identifier.
Can one-day and 28-day reports be added?
No. They are different windows and adding them can double count.
Can the API disable an agent automatically?
Begin with read-only observation and human approval before designing automated actions.
Source links
- GitHub Changelog: Usage Metrics API adds agent app activity (2026-08-07)
- GitHub REST API: Copilot usage metrics
- GitHub reference: Agent app metrics fields
What this means for everyday users
Keep agent_id, window, credits, members, repositories, and permission changes in the audit record.
Related reading
GitHub Copilot Sessions Can Move to VS Code With Context, Diffs, and Worktree Intact
GitHub has documented a handoff from a Copilot app session to Visual Studio Code. The workflow keeps the session context, changed-file diff, and the same isolated worktree, so a developer does not need to rebuild the task history in a new chat. This article explains the prerequisites and provides a practical review sequence: open the session, inspect the diff, edit locally, run the relevant tests, and decide separately whether to push. The feature is useful when agent work needs human judgment or local tooling, but continuity is not proof that the generated changes are correct. Repository permission, the same GitHub account in both applications, and an existing session with changes are still required.
GitHub Copilot Model Policy API Is Generally Available Across Four Control Levels
GitHub has made GET and PATCH endpoints for Copilot model policies generally available at four levels: enterprise, enterprise team, agent application, and organization. This is an administrative API release, distinct from the earlier global model policy interface. The article gives technical administrators a cautious workflow: read current state, save a baseline, identify the controlling level, review the intended delta, apply one minimal update, and read the result back. No live organization, credential, or production mutation is used in the example. The approach helps teams automate inventory and consistency checks without turning an API into an unreviewed bulk-change mechanism, especially where enterprise policy delegates control to lower levels.
GitHub Introduces HydraFusion Max: When Multi-Model Review Is Worth Trying
GitHub has updated HydraFusion and introduced HydraFusion Max, an orchestration option for demanding coding work. It is not a new standalone model: the system chooses how to draft, review, or revise a response using models allowed for the account. Both options remain research previews, so access and suitability need checking before adoption. This article explains the distinction from automatic single-model selection and proposes a bounded bug-fix comparison that records tests, changes, and usage. It does not rank model quality or promise lower cost. The suggested exercise is designed for people already using an AI coding assistant who want to decide when additional review passes are worth the time and credits.
GitHub Agentic Autofix Is Generally Available, but Humans Still Own the Merge
GitHub made Agentic Autofix for code scanning alerts generally available on October 15, 2026. After an eligible alert on the default branch is assigned to Copilot, the agent explores relevant files, proposes a fix, reruns CodeQL, iterates when needed, and opens a draft pull request for review. Teams can select as many as 25 alerts for one pull request, or assign the Copilot agent through the REST API. The feature is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, requires enterprise policy enablement and a Copilot billing method, and consumes both Code Security AI Credits and GitHub Actions minutes. This article provides a review checklist for scope, test evidence, hidden behavior changes, credit budgets, rollback, ownership, and final human approval before merge.
GitHub Copilot Model Retirement on November 16: A Migration Checklist
GitHub announced on October 15, 2026 that three models will be removed from GitHub Copilot experiences on November 16: Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra. The change covers Copilot Chat, inline edits, ask and agent modes, and code completions. GitHub recommends Claude Opus 5.5 for both Claude models and either GPT-6.1 Sol or GPT-6 Luna for GPT-5.6 Terra. Under default model enablement, suggested alternatives are enabled automatically for Copilot Business and Enterprise unless an administrator disabled the global default or the specific model. Claude Opus 4.8 remains available to individual annual subscribers as an exception. This guide provides a durable migration checklist for inventorying model references, checking policies, testing prompts and integrations, comparing quality and cost, communicating the switch, and keeping a rollback path before the deadline.
GitHub AI Scan for Pull Requests Is Generally Available: What It Checks
GitHub made AI Scan for pull requests generally available on October 15, 2026. When code scanning and the repository's effective AI Scan setting are enabled, it automatically reviews pull request changes and complements CodeQL for languages and frameworks that CodeQL does not currently cover, including PHP, Shell or Bash, Terraform HCL, Dockerfiles, Java JSP, and C# Blazor. Findings appear beside CodeQL results with an AI indicator and may include a risk explanation and suggested fix. They remain advisory: they do not fail the code scanning check and cannot block a merge through rulesets. This article explains repository eligibility, excluded fork and Dependabot pull requests, Code Security AI Credit billing, and a human-review workflow for confirming reachability, impact, tests, and residual risk before accepting a suggestion.
Summary
GitHub's new agent-app metrics give teams a sharper cost and permission view. Start with stable IDs and separate windows, then add governance only after a read-only audit is trusted.
