Inside GitHub's September updates: Project HydraFusion, sandboxing, and PR approvals

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: Inside GitHub’s September updates: Project HydraFusion, sandboxing, and PR approvals · Channel: GitHub · 13:02 · Watch on YouTube

Topics: AI agents, Cybersecurity and software security, Software engineering with AI, Model inference and optimization

Summary

The hosts discuss four GitHub updates from September: HydraFusion, local sandboxing, code review approvals, and bulk agentic autofix. HydraFusion routes tasks across models and provides visibility into its execution patterns, selected models, and credit usage; the demo reports substantially fewer credits than using GPT-6 Astra alone for the same task. Local Sandboxing is generally available across Linux, macOS, and Windows, while code review approvals can count toward required PR approvals. Bulk Agentic Autofix can assign up to 25 CodeQL findings to Copilot to fix and validate, with organizational rules and code review still applying.

Key points

HydraFusion aims to simplify model selection by routing each task to an appropriate model or model combination.
HydraFusion is available in the CLI, the GitHub Copilot app, and VS Code.
The product shows its chosen work pattern, models, live events, and credit usage.
In the demonstrated task, HydraFusion used roughly 50 credits, compared with 500 for GPT-6 Astra; the sessions took about 13 and 30 minutes, respectively.
HydraFusion uses a lightweight LLM to score prompts and select a route, such as Single, Cascade, or Critique.
Local Sandboxing is generally available for organizations on Linux, macOS, and Windows, at no extra cost with Copilot.
Code review assessments can be configured to count as required PR approvals, while existing admin controls remain in place.
Bulk Agentic Autofix can assign up to 25 code quality findings to Copilot to fix and validate in a branch.
The hosts invite feedback and feature requests, including requests for users to choose models and include local models.

Chapters

Start	Chapter	Summary
00:01	Introducing HydraFusion	The hosts introduce the September updates and explain how HydraFusion routes tasks across models to reduce the burden of choosing one.
02:37	HydraFusion in VS Code and its routing details	A demo shows HydraFusion’s execution patterns, model transparency, session history, and a comparison of credits and time with GPT-6 Astra.
07:17	Local Sandboxing and code review approvals	The hosts cover sandbox availability and explain how code review assessments can count toward required PR approvals.
09:53	Bulk Agentic Autofix	They describe CodeQL code quality findings and how Copilot can address and validate up to 25 findings at once.
11:57	Feedback and feature requests	The hosts discuss requests for model selection and local models before wrapping up the September update roundup.

Quotes

you just pick HydraFusion, and we’re going to do the model orchestration for you — 01:04

It shows you all of the live events that are happening under the covers. — 03:08

So you can now enable it for your organizations. — 07:17

now you get up to 25 findings that you can click at once and assign it to Copilot. — 10:55

Concepts and entities

HydraFusion, HyDRA, GPT-6.1 Sol, Luna, GPT-6 Astra, VS Code, Microsoft Execution Container, CodeQL, GitHub

Full transcript (original language)

00:01 Welcome, welcome, welcome. I’m Andrea Griffiths and I am here with my friends today, Julia and Brady. And we are going to dig into the September ships. So if we made it to the changelog, we’re going to talk about it. Because who can keep up with a million updates? Yeah, 14 million. 14 million. Yes, yes. Yes. There’s a lot happening, Julia, you are the PM for HydraFusion, which to me was sort of the marquee ship of the month of September. And in just four weeks, it’s changed a

00:32 lot. Can you tell us a little bit about HydraFusion and all the improvements that you brought in the past two weeks? Three weeks? Yeah. Well, already so much time has passed. But exciting. Yeah, because I’m kind of part of every model launch that we do across all of the different clients, one of the themes we have seen after talking to a lot of enterprise customers, including Microsoft, there are so many models that are launching every week that, hey, rather than you focusing on what is the best model you have to pick for your task?

01:04 What about if we take away that complexity and you just pick HydraFusion, and we’re going to do the model orchestration for you, and not just within one model, we’re going to bring in a fleet of models, and we’re going to pick the right and best route this model can take, so you don’t have to worry about it. And the most exciting thing, especially for enterprises, we are doing this to be way more token efficient than what we are seeing with some of the frontier other models, based on offline evals. So

01:34 Yeah, that’s cool. I was talking to a friend last night on the way to the Rush concert, which was fantastic, and I was asking him. I was like, have you tried HydraFusion yet? Because I’ve got this show tomorrow with Julia. And he was like, dude, that’s all I use these days. Like, I was like, is it like a different app? Is it a different harness? Like, how do I use it? And he goes, it literally appears like a model. He’s got it in the CLI and he goes instead of just picking, you know, this model or that model, you pick HydraFusion and it just does the right thing. I was pretty impressed by that. You just pick this router and it goes in the

02:05 right direction. I’d love to see a demo of it if you’ve got something, especially if it’s more efficient because. Yeah, of course. And so one of the big things, first of all, yes, we released it in the CLI. Number zero priority was we had to get it into the GitHub Copilot app. You also had to get it into VS Code. Yeah. So to truly reach as many people as possible and giving them the goodness of HydraFusion. Number two feedback was around what is happening. Like we need to better understand once you pick HydraFusion, what are the models that are being picked?

02:37 What are the execution patterns that HydraFusion picks for you? So we wanted to bring all of this into the product to be responsive to the feedback that we’ve heard here. So let’s take a look at some of the improvements here. As I mentioned, HydraFusion is now available in VS Code. The very first thing is it also tells you the work pattern that HydraFusion picked. So in this use case it picked Cascade. The next big thing was around model transparency, visibility. So we’re also showing what is the model that is now for this workflow

03:08 being picked and what is happening in real time? You’re also showing information, like if a subagent is being spun up, for example. If you even want more information of what’s happening, you can always click on the main path, here. It will open kind of like a flyout window. It shows you all of the live events that are happening under the covers. So if a terminal is being run, you can open this. You can close it. So all of the information or details are being shown here as well. Most important updates are always going to be in the main session. And once your session finished, I was

03:39 curious to see, hey, what are all of the models that are being used? You can also get transparency here. So in my session it used GPT-6.1 Sol, but also Luna. To your point about model orchestration routing. We are also of course showing how many credits are being used. In my use case it was roughly 50. If you ever want to go back and you kind of want to know, hey, what is the history? How was it used? It used Cascade. But then also what pass or what kind of steps certain models are being used. You can always go back and get all of this information. So I

04:12 actually spun up the exact same session with GPT-6 Astra and not HydraFusion. I was curious, hey, you’re talking about token efficiency here. So first of all, GPT-6 Astra throughout the entire session, that’s the only model that’s being used. As you can see here, it used 500 AI credits and so almost ten times more than HydraFusion did here, which got me so excited because I only did it once, I didn’t want to redo it, right. So yes, I was curious to see, hey, how many

04:42 credits are being used? So definitely excited about the token efficiency here. That’s very impressive. Yeah. Is the wall-clock time better too? Yeah. So this session took roughly 30 minutes versus the other one I want to say 13 minutes. So definitely also I mean Astra overall is a way bigger model, right? I was not too surprised by the overall time, but the credits just blew my mind off. So the exact same task what you can achieve through like how you orchestrate certain models. It’s just amazing. That’s incredible. That’s great.

05:12 I love that. We know now that not one single model can do every task well, so it’s great. I know your team has put a lot of work and effort into how that orchestration happened. So we have Single, Cascade, which is what we just saw, and then Critique. Yes. And each one is being chosen depends on the complexity of the task. Correct. Yeah. So what we do is once a developer types in their prompt we do a HyDRA scoring. HyDRA stands for hybrid dynamic routing architecture.

05:42 We use a very very lightweight LLM to go and route and like bring up a certain score. And depending on the score that is being picked, we know exactly what route it has to pick. But then also within this execution pattern, for example Cascade, what is the model mix you now have to use for execution here? Cool, I like that and I like that. You can see at the end exactly what it was, like it’ll tell you what it chose–how it chose to solve the problem, and then what models you were able to use. Getting this kind of feedback from our customers. It was super valuable and this is how we should

06:14 be evolving product, right? Ship it, get feedback in, and then improve. I am so, so excited to see these announcements here. That’s good. I’m excited about it because, you know, I like to use AI to get my stuff done. And a lot of times I’ll ask, you know, the guy that I went to the concert with last night and he’s like, well, you should use this model for this and this model for that because he’s like, you know, the AI guy in the room. Yeah, you know, you don’t have a lot of time to learn all these models and to keep up with them. I mean, that’s your job. You know, to keep up with all these models is complicated. HydraFusion kind of takes that responsibility off of my plate,

06:45 and I just use that and it goes in the right direction. At least that’s what it feels like. Yeah, totally. And then from a more enterprise angle…Yes, from a developer angle, you don’t want to worry about it. You just pick HydraFusion. And then from an enterprise angle–cost or how many tokens are being used. So if you combine these two things, we’ve heard amazing feedback. We’ve worked with a handful of enterprise customers really close to it and they have seen greatest results. So it’s definitely very exciting and a good route where we are going here, so, yeah. I’m definitely going to play with this. Oh, for sure. Yeah, this is

07:17 great. I mean, on the enterprise thing, I’m excited to talk about our next ship, too. Oh yes. Yeah. Yes, yes yes. So we have Local Sandboxing now generally available. So you can now enable it for your organizations. And for those of you who maybe are new to sandboxing, it’s going to be the safer way for you to let your agents have access to only the things that they need to have access to. So creating those secure environments so that your agents can go to work and you’re not worried about where they’re going to be roaming.

07:49 So you don’t want to give your agents too much agency. Exactly, exactly. But it’s under the hood is Microsoft Execution Container and now it’s generally available. You can use it in Linux, Mac, and Windows, macOS and Windows, and it’s included with Copilot at no extra cost. So all you have to do is do /sandbox, and that’s going to spin up the sandboxes for you. You can still send it out to cloud sandboxes, so you can still set it up for setting up the task for the GitHub Copilot cloud agent. That ship itself is going to help you accomplish a lot more,

08:20 because now you have this safe environment where the agents can actually go to work. And that brings us to the next ship this month, which is code review approvals, uh, which is huge. Now, before it would only it would take a human to go in and actually approve it for it to count towards your merge protection rules. But with this ship is actually it can be delegated. So if you have confidence on the assessments and you want to make that one of your requirements for merge, you no longer have to go in and just say every single

08:52 one. You can just say this is a good assessment. It’s ready to merge. Maybe that and one human reviewer and you’re good to go. Okay, so I can actually set that up as can that become a PR merge gate? Or… Oh for sure. I mean, you still have like the same admin control so. So, it doesn’t mess anything else. Okay. Yeah. You still have the same admin controls. And I feel like, to be fair, like a lot of us were doing, we had something like that in our CI, right? Yeah, I did. Yeah. We we built something like that in Squad because we deleted some code one day and we didn’t want to do that

09:22 again or the agents did it. Exactly. We so we wrote CI that would, you know, do essentially this would, would check every PR. Does it do this, does it have tests, does it do this, does it delete code, yada yada yada. You know, are there more than 20 files or whatever? Um, I get to turn that off now. We’ll just use this. I actually noticed it the other day that I was seeing our CI run and the new review run at the same time, and I thought, I’m probably wasting some cycles here. I think I can turn off the CI, so that’ll be nice. I have the built-in feature. Exactly. And again, it’s a real

09:53 approval review and it’s going to count towards those required approvals. So now your org can set it up and you take that extra layer of maintenance. I feel like the topics this month were all about just getting Copilot to handle more of this kind of stuff, and then you can focus on the important things. And then finally the Bulk Agentic Autofix. So this is one of my favorite things. I love CodeQL. It’s been doing an amazing job as far as finding like security concerns, but now

10:24 it’s focused on code quality as well. And those scans are free. You can run them in your repositories, but now it’s going to give you the assessment that’s going to be focused not just on the security aspect, but the code quality and maintainability of your codebase, which when we get excited and start shipping things, a lot of times we don’t think about the long, the long view. Yeah. Especially when we’re using HydraFusion with a bunch of different agents. Exactly. Being way more efficient because we’re sandboxed in. Yeah, exactly. So now our code quality is going to do this scan, and it’s going to give

10:55 you all of this feedback on the things that you can do to improve the maintainability and the quality of your code. But then you used to have to like, delegate each task to a cloud agent to go and actually do like, I guess, the remediation of the patching. Well, now you get up to 25 findings that you can click at once and assign it to Copilot. And then Copilot is going to create a branch. It’s going to fix the findings. Do the validation. Basically it’ll run through the entire cycle and you just click the button at once. That’s fantastic. Yeah. That’ll make things a lot

11:27 more efficient for sure. Absolutely. Absolutely. Of course, this is going to respect your organization’s rules as far as you know what what actually should be merged. Um, still review the code, but then you can spin up the jobs to be done in a way that’s much more efficient. Does it go as far as to like, suggest refactoring and whatnot? Does it, does it does it do that level of depth? Oh, it’ll do a lot of things. I mean, if you have um, let’s say there is duplicate logic in the code, if there is some functions that are more complex than they should be, and because Copilot is there

11:57 and has access to your entire codebase, it’s going to give you a better assessment. Exactly, exactly. So all that backlog that nobody wants to work on, like who likes going back and doing those maintenance things? Maybe somebody that’s not me. Um, then you just assign it to Copilot and boom, it’s done. That’s cool. It’s done. So those were four things during the month of September, Julia. Like in one month, we covered a lot. I’m excited for the future of HydraFusion. I have a feature request. I want to pick the models that I can and that I know. Yes, number one.

12:30 Okay, good. Okay, good. Good. I love it. I didn’t know this was going to come with feature requests, but please. Please do. Yeah. It’ll be great. But honestly, though, and because you have done such incredible work and the researchers that are working on this, like there’s a lot of thought that goes into the evaluations and how the orchestration happens. I have confidence on it. I think for me, just be just out of preference and being able to like just pick, um, even further like local models would be nice to include in the mix. I also made a feature request for that. We’re listening!

13:02 Yeah, very valid. We’re hearing a lot of these feedbacks or sentiments from customers, so definitely something real there. So keep telling us because the team is listening. Yeah, I love it. Thank you both so much for stopping by. And that was September Ships. So thank you. Thank you thank you. Thanks a lot.