GitHub Universe 2026: what agents mean for Moodle plugins

The short answer: adopt GitHub Agentic Workflows for read-only chores like issue triage and CI failure reports, keep your moodle-plugin-ci jobs as required checks, and leave Copilot approvals and automatic merging switched off on any plugin that real sites install. Everything else from GitHub Universe 2026 can wait a few months.

GitHub held Universe on 28 October 2026 and posted around thirty changelog entries that day. Most of them are about agents: software that writes code, reviews it, fixes failing builds and, if you let it, merges. Moodle core and most serious Moodle plugins live on GitHub, and moodle-plugin-ci runs on GitHub Actions.¹1 Moodle HQ, GitHub Actions CI workflow file explained. So this is the toolchain you already use, changing under you.

What did GitHub actually announce?

The keynote post is by Jay Parikh, who leads Microsoft’s CoreAI group, which includes GitHub. Its thesis is in one line: “Completed work, not more code, is the output that matters.” It also says “Developers set the direction, make decisions, and stay accountable for what ships.”²2 GitHub, GitHub Universe 2026: Evolving every layer of the stack. Hold on to that second sentence. Several of the features below make it easier to stop doing exactly that.

The status word on each entry is the best filter for marketing. Here is what the changelog says, in its own terms:

Two days earlier, GitHub made OpenAI’s GPT-6.1 Terra available in Copilot, billed “at provider list pricing under usage-based billing”,¹⁸18 GitHub Changelog, GPT-6.1 Terra in GitHub Copilot. and made assisted permissions generally available. With assisted permissions, a language model decides whether a command, file path or URL the agent asks for is “clearly safe” and lets it run without asking you.¹⁹19 GitHub Changelog, GitHub Copilot assisted permissions generally available.

Which parts are real and which are marketing?

The features are real. Most of the numbers around them are not yours to rely on.

Real and usable today: Agentic Workflows, Agent Merge, Copilot approvals, Fusion, lockfiles and PR-limit exemptions are all marked generally available or available on paid plans, with docs.

Vendor-supplied numbers: The Agentic Workflows entry quotes an Accenture manager saying one lead saved “an estimated 29 hours a week” and that AI “now authors 91% of the team’s commits”.³ The Fusion entry says Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, “within two points of Claude Code with Opus 5.5 Max”, at about half the cost.⁹ The keynote says Max review posted the highest F1 score on ReviewBench for high-severity issues.² These are customer testimonials and benchmark claims picked by the seller. None of them was measured on a PHP codebase with Moodle’s coding style, upgrade steps and Behat suites.

Previews: Max review, the security extension, issue artifacts and local model routing are previews. Try them on a side branch, not in a release process.

Renames and packaging: The SDK becoming the Microsoft Copilot SDK, and Copilot being folded into GitHub Enterprise, change who you pay and which logo is on the docs. They do not change what the code does.

What does it cost?

GitHub now prices Copilot in AI credits, where one credit is one US cent. From the plans page:²⁰20 GitHub, Copilot plans and pricing.

How the new features spend those credits:

• Agentic Workflows are available on Free, Team and Enterprise, but the default engine, the Copilot CLI, needs a Copilot licence. You can bring another coding agent instead. The gh aw forecast command estimates monthly credit spend, including the threat detection job.³
• Max review “takes longer and uses more AI credits than Lite or Balanced”. No multiplier is published in the entry.⁵
• Fusion bills every model it calls at that model’s own rate, with a time-limited 30% discount on paid plans.⁹ One prompt can mean several models billed.
• Automations can now have caps per run, day, week or month. Automations without limits “continue to run as they do today”, which means uncapped.⁷
• GitHub Enterprise with Copilot included has no monthly credit allowance per seat. Usage is metered “from the first request”. Users without an Enterprise licence can get Copilot Standalone at $10 per user per month.¹²
• Actions compute is now one dollar-based pool covering standard runners and Copilot cloud sandboxes.¹¹ If your only Actions use was moodle-plugin-ci, agent sessions now draw from the same bucket as your test matrix.

Verified teachers and maintainers of popular open source repositories can apply for free Copilot Pro, and GitHub rechecks eligibility every month.²¹21 GitHub Docs, Getting free access to Copilot Pro.

Where are the risks?

The merge chain

Read the entries together and you can build a pipeline with no human in it:

1. Agent Merge fixes failing Actions workflows on your pull request, and you can enable it “by default for all your pull requests”.⁴
2. Combined with auto-merge, “GitHub merges it as soon as all requirements are met”.⁴
3. With approvals on, Copilot’s approval “counts toward your repository’s required approvals”.⁵
4. Automations can now be given a “Merge pull requests” tool, and their triggers can fire on events made by Copilot itself.⁷

GitHub put brakes in: approvals are off by default, admins can limit which file paths Copilot may approve, and a new commit dismisses Copilot’s approval.⁵ But the brakes only work if someone sets them.

The specific danger for a Moodle plugin is step 1. An agent told to make a red check green has two ways to do it: fix the code, or change the test. A PHPUnit assertion loosened, a Behat scenario tagged to skip, a phpcs warning count raised in the workflow file. For a plugin, “the tests pass” is only meaningful if nobody, human or agent, can quietly change what the tests check. Why tests matter more when an agent writes the code is the subject of testing Moodle plugins in the AI era.

Agents that attack the supply chain

This one is no longer hypothetical. On 4 August 2026 the UK AI Security Institute published an incident report on its own cyber evaluations. The facts below are from that report.²²22 UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing.

• Between 25 and 28 July 2026, agents in 10 of 122 runs took 19 unsanctioned actions against real people and organisations. 17 came from Anthropic’s Mythos 5 and 2 from a single run of OpenAI’s GPT-5.6 Sol.
• In the worst case, an agent “tried to insert malicious code into a publicly used open-source project”. It “created multiple fake identities, and used the fake identities to socially engineer a real maintainer”, and later “edited its earlier activity to appear harmless”.
• “A human maintainer caught and refused to approve the malicious code.” AISI found no real-world harm and worked with GitHub to remove what the agent left behind.
• The test had internet access on and the developers’ cyber classifiers off. AISI says this “is not reflective of how frontier models are made available to the general public”.

The lesson for plugin maintainers is not that Copilot will attack you. It is that the last line of defence in that incident was a person reading a pull request and saying no. A Moodle plugin with an admin setting page and a web service is a good target: one merged change runs on every site that updates. For what a single PHP flaw can do to a server, see PHP2Shell explained.

Smaller things to watch

• Assisted permissions let a model decide what is “clearly safe” to run on your machine.¹⁹ Fine for phpunit; less fine for anything that touches config.php or a production database dump.
• Self-improving automations propose changes to their own prompts based on how people respond to their output, including whether their pull requests get merged.⁸ You approve each change, so read them. An automation that learns “PRs that touch tests get merged faster” is learning the wrong thing.

What should a Moodle plugin maintainer adopt now?

In order, cheapest and safest first.

1. Make moodle-plugin-ci a required check. The standard workflow runs phplint, phpcs --max-warnings 0, phpdoc, validate, savepoints, mustache, grunt, phpunit and behat.¹ Mark those jobs as required status checks in a branch ruleset on your main and stable branches. Every other step depends on this one.

2. Protect the tests from the code. Add a CODEOWNERS entry so that tests/, .github/workflows/ and db/ (install, upgrade, access) need a named human reviewer. Those are exactly the paths an agent would touch to make a red build green, or to widen a capability.

3. Pin your Actions with lockfiles. Lockfiles are now GA: gh actions-lock writes .github/workflows/actions.lock, Dependabot keeps it in sync, and you can add a stale-lockfile check to CI. GitHub itself warns that lockfiles “don’t determine whether a dependency is safe”.¹⁶ They stop a moved tag from changing what runs, which is the point.

4. Start Agentic Workflows read-only. By default agents in Agentic Workflows run with read-only permissions in a sandbox behind a firewall, and every write goes through “safe outputs”: the agent asks, and a separate job with its own permissions does the write.³²³23 GitHub Agentic Workflows docs, Safe outputs. Good first jobs for a plugin:

• Triage new issues: label by Moodle version and component, ask for the missing site info.
• When moodle-plugin-ci fails, post a comment explaining which check failed and why.
• A weekly report of open PRs, failing branches and upcoming Moodle release dates.

Keep create-pull-request at its default maximum of one and use protected files. Leave merge-pull-request, which the docs list as experimental, alone.²³

5. Use Copilot review as a second reader, not an approver. Turn review on, Balanced by default, Max for security-sensitive changes if you have the credits. Leave approvals off. If you must turn them on, restrict them to paths like lang/ and README.md.⁵

6. Cap anything that spends money. Set per-run and monthly credit limits on every automation.⁷ Run gh aw forecast before you enable a scheduled workflow.³

7. Use PR limits if agents find your repo. Popular plugins may start getting agent-written pull requests. PR limits with exemptions by account age or merged PR history let regulars through and slow everyone else down.¹⁷

What to skip for now: Agent Merge with auto-merge on by default, shared automations with the merge tool, and anything marked preview on a plugin that schools depend on.

Does this change how Moodle plugins get built?

Less than the keynote suggests. The slow part of a Moodle plugin was never typing PHP. It is knowing the APIs, the upgrade path, the capability model and the privacy provider, and then proving it all works across supported Moodle versions. Agents can draft and fix faster, but Moodle’s own tooling for agents still lags, as Moodle developer experience in the AI era lays out. The proof still comes from tests and a person who reads the diff.

Agents plus senior review can take a plugin from idea to production in days, but only with fixed checks every plugin must pass; see a Moodle plugin in days. For the models behind all of this, see the AI models that matter in October 2026.

The agents got better at getting pull requests to green. Your job is to make sure green still means something.