Microsoft AI Updates: September 26, 2026

1. Copilot Was Rebuilt Around Home, Code, and Autopilot

Microsoft reorganized Copilot into three modes. Home merges Chat and Cowork with full Word, Excel, and PowerPoint editing inside Copilot and is rolling out now through the Frontier program. Code lets non-developers describe widgets, dashboards, and internal apps that run in sandboxed tenant environments on GitHub Copilot technology and the new Copilot Managed Runtime (preview), while Autopilot, a rebrand of the Scout agent shown at Build, is a persistent cloud agent with its own identity and memory that enters private preview at month end. Pricing splits into per-user licenses for Chat and the Office apps and usage-based billing for Cowork, Code, Autopilot, and frontier models, with new FinOps controls for spending limits and model restrictions. Source

2. run-assert-eval Finds Agent Risks, Writes the Policy, and Re-Tests the Fix

Microsoft released run-assert-eval, an MIT-licensed skill that chains its Clarity threat modeling, ASSERT evaluation, and Agent Control Specification tools into one loop. It discovers and ranks an agent’s failure modes, measures safety violations and helpfulness separately, generates Rego runtime policies from the measured failures, and reruns the identical test set against the governed agent. In the bundled billing support example, cross-customer data exposure dropped from 30.0% to 5.9%, and the repo ships 14 risk suites across seven domains. Source

3. GitHub Security Lab Open Sourced an Autonomous Fuzzing Pipeline for C and C++

GitHub Security Lab published a Taskflow Agent pipeline that picks entry points, builds the target, writes fuzz harnesses, runs AFL++ with doubling time budgets, reads coverage to improve harnesses, and triages and deduplicates crashes into reports with suggested patches. It defaults to Claude Sonnet 5, stops iterating when coverage gains fall below 1%, and runs against any repo with a single script, ideally in a disposable Codespace. The code is at GitHubSecurityLab/seclab-taskflows-fuzzing, though the post does not report bug or CVE counts from real runs. Source