GitHub Universe landed on October 28 with more product than most teams can read in one sitting: a cloud agent that watches your pull request and fixes what blocks it, automations that rewrite their own prompts, a scanner that goes looking for bugs CodeQL can’t see. Two days later, Claude Code shipped a boundary that holds no matter which permission mode you picked. Read together, this week answers a narrower question than “what can agents do now”: who decided, in advance, exactly how far each one gets to go alone.
What happened
GitHub shipped a cloud agent that fixes what blocks your pull request, not just what’s in it. Agent Merge, announced October 28 for paid Copilot plans, works from the merge box: select “Watch and fix,” and in GitHub’s own words, “Copilot watches your pull request and automatically fixes blockers.” “When a selected blocker appears, Copilot starts working in a cloud development environment to fix it.” You choose whether it resolves failing Actions workflows, merge conflicts, or both, and it can pair with auto-merge so the PR ships the moment it’s clean. This used to be the moment a human got pinged to rebase or rerun CI. Now it’s the moment nobody gets pinged, by design, for the two failure modes GitHub decided are cheap enough to hand off.
Copilot Automations learned to read their own track record and propose changes to themselves. The feature, also from October 28, runs on what GitHub calls the signals an automation “leaves a trail of” on GitHub: whether people keep the labels it applied, whether developers accept its review comments. A separate improvement automation reads those signals and proposes edits to “the original automation’s prompt, tools, or triggers.” The seam is explicit: every suggested change “comes to you for review before it’s applied.” That’s evidence-based development running on the automation’s own behavior instead of the code it touches, with the same rule intact: the evidence proposes, a person still ships.
GitHub put an agentic scanner on the whole repository, not just the diff. AI Scan entered public preview the same day, covering, per the announcement, “languages and frameworks that CodeQL doesn’t support,” plus issues rule-based analysis misses even where CodeQL already runs. Findings land in the same alert list as CodeQL’s. The constraint is the part worth noting: “each scan runs within a fixed time budget, which keeps its cost bounded.” Software assurance has always meant choosing what gets checked, because checking everything forever isn’t free. GitHub just built that trade-off into the product instead of leaving it to whoever configures the pipeline.
Claude Code added a permission that no permission mode can override. Version 2.1.314, shipped October 30, adds permissions.blockWritesOutsideWorkingDirectories: with it set, Write, Edit and NotebookEdit “refuse paths outside the working directories in every permission mode.” Auto mode, accept-edits, default, none of it matters; the boundary holds regardless of what else is configured to trust the agent. It’s a narrow fix, but it’s the clearest statement all week of what a contract actually is: not a rule a well-behaved agent follows, but one it cannot be configured around.
GitHub also shipped the thing that decides which model does the work. Copilot Fusion went generally available October 28 with two mechanisms replacing manual model-picking: a cascade, where “a quality check determines whether to accept it or escalate to a stronger model,” and a critique, where “one model drafts an initial response, another model reviews it, and the original model revises.” GitHub’s benchmark claim: Fusion Max “scored 60” on the Artificial Analysis Coding Agent Index, “within two points of Claude Code with Opus 5.5 Max,” using about half the tokens and roughly 40% less time per task. That’s routing between models as a built-in escalation policy instead of a developer’s manual choice.
How to read it
Every one of these is the same decision made in a different place: let the agent act without asking first, but fix in advance exactly where the leash is tied. Agent Merge touches only two named failure modes and needs an opt-in plus a paid plan. Automations self-improvement needs your yes before anything ships. AI Scan’s time budget caps how much checking you get for free. Fusion’s cascade escalates on a quality check, not a vote of confidence. Claude Code’s new permission is the most absolute of the five because it has no opt-out: no permission mode lets a write land outside the working directory. None of this is a vendor deciding agents are trustworthy. It’s five separate decisions about which failure is cheap enough to let happen without a person watching.
The noise this week: reading GitHub’s “scored 60, within two points” as Fusion beating, or losing to, Claude Code on capability. The post doesn’t say which side of 60 Opus 5.5 Max landed on, so that comparison isn’t resolvable from what GitHub published. Competitive is the only claim the number actually supports.
What to watch
Claude Code’s own release notes confirm fast mode for Opus 4.8 is deprecated as of October 30 and will be removed on November 30, 2026, after which requests return an error instead of falling back to standard Opus 4.8. That’s a boundary with an expiration date instead of a permission flag, worth re-checking once the date passes: whether teams still relying on Opus 4.8 fast mode actually moved to Opus 5.5 before it closed.