October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
Redmond desk3 min

GitHub Copilot After 10 Months: What Reliable Autocomplete Still Can’t Tell You

Copilot can speed up coding, but a ten-month reliability claim needs real examples—and autocomplete, code review, and security evidence each have important limits.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

GitHub Copilot’s inline suggestions can be useful autocomplete, but the product’s behavior and published security evidence do not establish how reliable it was in one writer’s workflow over ten months. That experience needs dated examples, a defined measure of reliability, and failures as well as successes. Separately, generated code can be syntactically correct yet insecure, and the available security studies are warnings about specific samples—not a verdict on every current suggestion.

What “reliable autocomplete” should mean

“Reliable” is meaningful only when it describes a particular workflow. A personal ten-month review should identify the languages and IDE used, the kinds of tasks attempted, and what counted as a useful completion. For example, acceptance rate alone would not show whether accepted code worked, needed substantial edits, or introduced defects. Without the author’s dated examples and a defined measure, the ten-month claim remains a personal assessment rather than a measured product-wide accuracy rate.

As an Amazon Associate I earn from qualifying purchases.

GitHub describes Copilot inline suggestions as autocomplete-style output that can complete a line, generate a code block, or propose edits—including insertions, modifications, and deletions. Suggestions use surrounding code and contextual information such as open editor tabs; developers choose to accept, dismiss, or ignore them. GitHub’s inline-suggestions documentation explains the feature and its limits.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Can you trust Copilot’s code?

Not without review. GitHub says suggestion quality varies with the amount and diversity of training data for a language, and that inline suggestions may miss larger design or architectural problems. Its documentation also cautions: “While inline suggestions can generate syntactically correct code, it may not always be secure.” In practice, treat a completion as a draft: check whether it fits the surrounding code, test the behavior, and review security-sensitive logic before relying on it.

Security research provides a reason for that caution, but its results need careful boundaries. A 2024 study by Fu, Liang, Tahir, Li, Shahin, Yu, and Chen analyzed 452 Copilot-generated snippets from GitHub projects. The authors reported security weaknesses in 91 of 277 sampled Python snippets (32.8%) and 43 of 175 sampled JavaScript snippets (24.6% in the paper’s table; the abstract rounds this to 24.5%). Across the sample, 134 snippets had weaknesses, with 544 issues spanning 38 CWE categories. These figures describe that study’s selected sample and method—not the share of all Copilot output that is insecure, and not a measurement of today’s product. The study appeared in ACM Transactions on Software Engineering and Methodology in April 2024.

Can Copilot Code Review catch security vulnerabilities?

It should not be treated as the only security check. A preprint submitted to arXiv on September 17, 2025, by Amena Amro and Manar H. Alalfi evaluated Copilot Code Review using curated vulnerable samples from different projects, languages, and domains. The authors reported frequent misses of critical vulnerabilities such as SQL injection and cross-site scripting; feedback often concentrated on lower-severity style or typographical issues. Their examples included vulnerable test projects receiving few or no relevant comments. This is evidence about that particular evaluation, not a benchmark for every repository, product version, or Copilot security feature. Read the preprint’s abstract and details.

GitHub’s own guidance says generated code should be reviewed and tested for errors and security concerns. A practical workflow is to combine human review with tests and security tooling appropriate to the project; none of those checks should be assumed to replace the others. GitHub’s Copilot Chat guidance also recommends reviewing and testing generated code.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Does GitHub use Copilot prompts or code for training?

GitHub announced on March 25, 2026, that starting April 24, 2026, it would use interaction data—including inputs, outputs, code snippets, and associated context—from Copilot Free, Pro, and Pro+ users to train and improve models unless those users opted out. The announcement says this change does not affect Business and Enterprise users. GitHub’s product page says individual subscribers can opt out through Copilot settings; check the current setting and plan terms because they may change. Read GitHub’s March 25, 2026 announcement. See GitHub’s Copilot product information.

For Copilot Chat, GitHub also notes that when Bring Your Own Key is active, prompts and responses go to the selected model provider and may be governed by that provider’s data-retention and privacy policies. Consider the applicable plan, settings, and provider terms before sending sensitive material.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What GitHub’s public-code figure does—and doesn’t—say

GitHub says suggestions matching public code occur in fewer than 1% of cases, based on GitHub’s own research, and describes a public-code filter and code-referencing feature on its product page. That figure is about public-code matching, not security: it does not establish that a suggestion is safe, correct, or clear of licensing concerns.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.