GitHub Copilot code review launches Max for multi-agent reviews and makes approvals generally available
GitHub has added a third and most thorough effort level to GitHub Copilot code review. Called Max, it is available in public preview from October 28, 2026, and it works differently from the two existing levels: instead of sending a pull request to a single reviewing model, Max runs several independent review agents built on models from different providers, then passes their findings to an aggregation agent that reconciles them, resolves disagreements and double-checks accuracy before a single combined review is posted on the pull request.
The same changelog entry moves Copilot approvals from public preview to general availability. When an administrator turns the feature on, Copilot can submit an approving review that counts toward a repository's required approvals, exactly as a human reviewer's approval would. Both features are available on Copilot Pro, Pro+, Max, Business and Enterprise plans, and both were announced alongside the wider set of releases GitHub presented at its Universe 2026 conference.
In its Universe 2026 announcement post, GitHub said that Copilot code review Max "posted the highest F1 score on ReviewBench for high-severity issues". The company did not publish the score itself, the scores of the other systems it was compared with, or the details of the test set, so the claim cannot yet be checked independently. GitHub positions Lite and Balanced as the levels that keep everyday reviews fast, and Max as the option for changes where a missed defect is expensive.
··········
HOW THE MAX EFFORT LEVEL WORKS.
Until now, Copilot code review offered two effort levels. Lite is described in GitHub's documentation as a standard review focused on bugs, security vulnerabilities and style issues, and it is the faster and cheaper option. Balanced sends the pull request to a higher-reasoning model for deeper analysis of complex logic, security-sensitive code and changes that cross service boundaries. Balanced became the default for new and existing repositories and organizations on September 28, 2026, while users who had explicitly chosen Lite kept that setting.
Max adds a different architecture rather than simply a larger model. According to the changelog, it "runs several independent review agents across models from different providers", and an aggregation agent then reconciles what they found. The design follows a familiar idea from human review practice: several reviewers who look at the same change independently tend to catch different problems, and a final pass that compares their notes can discard weak findings and keep the ones that hold up. GitHub has not said how many agents Max runs, which providers or models it uses, or whether the composition changes over time.
That lack of detail is consistent with how GitHub documents code review in general. The product documentation describes the system as a "carefully tuned mix of models, prompts, and system behaviors", states that users cannot switch the models it uses, and notes that code review may use models that are not enabled on an organization's Models settings page, because that page controls only Copilot Chat. Organizations that restrict which model providers their developers may use should therefore read Max as a GitHub-managed service rather than as a choice of specific models.
The trade-off is stated plainly in the announcement: Max takes longer and uses more AI credits than Lite or Balanced, because it does more work per review. GitHub presents it as the level for higher-risk changes, such as those touching authentication, payments, data migrations or shared infrastructure, rather than as a replacement for the default.
........
Effort level | What it does | Status | Estimated AI credit cost per review |
Lite | Standard review of bugs, security issues and style | Generally available | $0.05 to $1 |
Balanced | Higher-reasoning model for complex, security-sensitive and cross-service changes | Generally available, default since September 28, 2026 | $0.25 to $5 |
Max | Several independent agents on models from different providers, plus an aggregation agent | Public preview since October 28, 2026 | Not published; higher than Balanced |
........
The cost estimates for Lite and Balanced come from GitHub's code review documentation and exclude GitHub Actions minutes. When we checked the documentation on October 30, 2026, the configuration guide still listed Max as "Coming soon" and gave no consumption estimate for it, so the only official guidance on its price is that it costs more than the two other levels.
··········
WHAT CHANGES WITH GENERALLY AVAILABLE APPROVALS.
Copilot approvals entered public preview on September 1, 2026. Since then, every Copilot review has included an approval assessment in the pull request overview comment, stating whether Copilot considers the change ready to approve. On its own, that assessment has no effect on merge requirements. The feature that matters for workflows is the next step: with approvals enabled, Copilot submits an actual approving review, and that approval counts toward the number of approvals a branch rule requires.
The behavior mirrors a human reviewer's approval in the way it expires. If new commits are pushed after Copilot approves, the approval is dismissed, and a fresh one requires a new Copilot review. This prevents a Copilot approval given at one commit from carrying over to later changes that Copilot has not reviewed.
Approvals are off by default and are controlled at three levels. Enterprise administrators decide whether organizations may use them at all, and the documented enterprise default is "Disabled everywhere". Organization administrators can enable approvals everywhere, let repositories decide, enable them for selected repositories, or disable them everywhere. Repository administrators can then turn approvals on and choose which file paths Copilot is allowed to approve.
........
Scope | Where the setting lives | Options |
Enterprise | AI controls, Available Agents, Copilot code review | Let organizations decide, enable for selected organizations, disabled everywhere (default) |
Organization | Settings, Copilot, Code review | Enabled everywhere, let repositories decide, selected repositories, disabled everywhere |
Repository | Settings, Copilot, Code review, Auto-approval | Allow Copilot to approve; count approvals toward merge requirements; file path globs |
........
The file path control is the most important safeguard in practice. GitHub's documentation explains that repository administrators can enter one glob pattern per line, up to 15 patterns, and that Copilot approvals count only when every changed file in the pull request matches one of them. Leaving the list empty lets approvals count for all files. A team could, for example, allow Copilot approvals to satisfy the review requirement for documentation, tests or front-end copy, while keeping human approval mandatory for infrastructure code, database migrations and security-sensitive modules.
··········
AVAILABILITY, PLANS AND COSTS FOR TEAMS.
Both features are available on all paid Copilot plans that include code review: Copilot Pro, Pro+, Max, Business and Enterprise. Copilot Free does not include code review. For organizations on GitHub Enterprise, the change also interacts with another Universe announcement covered by Data Studios, GitHub Enterprise now includes GitHub Copilot with no seat charge and AI usage billed from the first request, under which Enterprise customers can use code review without a separate Copilot subscription and pay only for the AI credits they consume.
Every review consumes AI credits, GitHub's usage-based billing unit, and reviews on private repositories also consume GitHub Actions minutes, because the review agent uses a tool-calling architecture that runs on GitHub-hosted runners. That second charge has applied since June 1, 2026. Public repositories are not affected, and self-hosted runners do not consume Actions minutes, although larger GitHub-hosted runners are billed at higher per-minute rates.
Who pays depends on how the review was triggered. Automatic reviews are charged to the pull request author, manual requests to the user who asked for the review, and reviews of pull requests opened by bots, or requested by bots, to the organization. Licensed members are billed against their own entitlement by default, and if that quota runs out the review fails. Since October 8, 2026, organization owners can instead bill reviews to the organization that owns the repository, an option that requires AI credits paid usage to be enabled and supports an optional budget. When a budget is exhausted, reviews are blocked together with other features that consume AI credits.
The official cost ranges allow a rough planning exercise, with the caveat that GitHub gives ranges rather than a formula. A team that sends 200 pull requests a month through Balanced reviews would spend between $50 and $1,000 in AI credits on code review, before Actions minutes, while the same volume on Lite would cost between $10 and $200. GitHub has not published a range for Max, which is why the new level is better suited to a selected subset of high-risk pull requests than to every change.
··········
HOW TO TURN ON MAX AND LIMIT ITS USE.
Max can be selected for a single pull request from the Reviewers menu, or set as the default effort level for a repository, an organization or an enterprise. As with the other levels, the narrower scope wins: GitHub's documentation lists the order of precedence as the level selected when the review is requested, the level previously used on that pull request, the requester's personal setting, the repository setting, the organization setting, and finally the built-in Balanced default.
The new control for budget-conscious organizations is a maximum effort level. Enterprise, organization and repository administrators can set a ceiling, and levels above it become unavailable in that scope. An enterprise can therefore keep Max out of reach for most teams while allowing it in repositories that hold critical services, or allow it everywhere but keep Balanced as the default so that developers opt into the more expensive review only when they choose to.
Reviews can also be requested programmatically. Since October 2, 2026, the REST and GraphQL APIs accept a Copilot code review request with an optional effort level, which lets teams build their own rules, for instance requesting a higher effort level when a pull request touches specific directories, while every other change receives the default review. Combined with branch rulesets that request Copilot reviews automatically on new pushes or draft pull requests, this gives administrators fine control over when the most expensive level runs.
··········
WHAT REMAINS TO BE VERIFIED.
The verified facts are clear. Max is in public preview on Copilot Pro, Pro+, Max, Business and Enterprise, it runs multiple independent review agents on models from different providers with an aggregation step, it costs more than Lite and Balanced, and administrators can cap the effort level by scope. Copilot approvals are generally available, off by default, configurable at enterprise, organization and repository level, restricted by up to 15 file path patterns, and dismissed when new commits arrive.
Several points are still undisclosed. GitHub has not published the number of agents in a Max review, the models and providers involved, the AI credit range per review, or the ReviewBench results behind its claim of the highest F1 score for high-severity issues. Its own documentation, at the time of writing, had not yet been updated to describe Max as available or approvals as generally available.
The more consequential change may be the second one. Allowing an AI reviewer's approval to satisfy a required-approval rule shifts part of the merge decision from people to Copilot, and GitHub's documentation still warns that Copilot is not guaranteed to catch every issue and can make mistakes. The file path restrictions, the dismissal of approvals on new commits and the default-off settings indicate that GitHub expects organizations to adopt the feature selectively, starting with low-risk parts of a codebase, and readers following GitHub's broader agent strategy can find the routing layer behind these reviews in our coverage of GitHub Copilot Fusion and automatic model routing.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
