GitHub Retires Four Copilot Models While Claude Code Stable Lacks Fail-Closed Fixes

Today’s lead changes are quieter than a launch: four Copilot model ids are simply gone, and a Claude Code release makes permission checks fail closed where a check that could not run used to be skipped.

Treat today as the day you find the four retired names in your repos and enable the replacements in Copilot policy, confirm claude --version prints v2.1.288 wherever you use allow rules, hooks or bypass mode, and leave /computer off until someone owns it.

Top Stories

1. Four Copilot models are retired, and Kimi K3 needs an explicit switch

GitHub’s changelog says that as of 2 Oct 2026 these models are deprecated across all Copilot experiences, including Chat, inline edits, ask and agent modes, and completions:

• Gemini 3.5 Flash is replaced by Gemini 3.8 Flash.
• Gemini 3.6 Flash is replaced by Gemini 3.8 Flash.
• Kimi K2.7 Code is replaced by Kimi K3.
• Claude Opus 4.7 is replaced by Claude Opus 5.5.

This executes a slate GitHub announced on 3 Sep, with one change: that notice named Claude Opus 5 as the Opus 4.7 alternative, and today’s names Opus 5.5. Today’s post says Enterprise administrators may need to enable the alternatives in model policy, and the 3 Sep one also named Business, so a Business admin should check too.

The enable step matters most for Kimi K3. GitHub’s supported-models page says open-weight models, Kimi K3 among them, are excluded from the default-availability policy and stay disabled until an admin turns them on, while GA models such as Opus 5.5 follow your default unless you configured them. GitHub’s pricing page lists Opus 5.5 at $4 per million input tokens and $20 output, and Kimi K3 at $3 and $15.

GitHub does not say what happens to a saved model choice or a workflow that names a retired model, so test that instead of assuming.

Practical dev impact: Search repos, prompt files and CI for the four names, and enable Kimi K3 in policy before anyone is pointed at it. Opus 4.7 to Opus 5.5 is a different model with its own price ($4 in, $20 out), so choose it on purpose. Another batch is scheduled for 19 Oct.

2. Claude Code v2.1.288 stops treating a check that could not run as a pass

Two fixes in the v2.1.288 notes change how permissions fail. First, a dangerous rm, such as one on / or the home directory, inside a bash -c or sh -c script used to run without a prompt in bypassPermissions mode or under a shell allow rule. The linked report (issue 96300, filed against v2.1.280 on Windows with Git Bash) explains why: the check looked for commands whose program is rm, and in sh -c "rm -rf ..." the program is sh. The reporter adds that no text check can cover every wrapper, since a script file or python -c gets past it, and the changelog names only bash -c and sh -c, so read the fix that narrowly.

Second, PreToolUse and PermissionRequest hooks were skipped when matching them failed or when the tool’s input could not be serialized to JSON, and now the call is blocked. That concerns the step that decides which hooks apply failing, or the tool’s input not converting to JSON, not a matcher that simply does not match, and the notes link no example. The direction is clear: when that step fails, the call is now blocked instead of running without the hook.

The same notes fix the npm auto-updater reporting success when only the placeholder claude stub was installed, and add /code-review --max-findings N, where N is a number, or --max-findings all, which sticks until you pass --max-findings default; Anthropic’s code review page documents it as needing v2.1.288 or later.

On channels, npm latest and next are v2.1.288 and stable is v2.1.285, and the native installer’s stable pointer is also v2.1.285 as of 6:07 AM ET Saturday. Anthropic’s docs make latest the default, so machines still on v2.1.285 chose stable through autoUpdatesChannel, the Homebrew claude-code cask, or the apt, dnf and apk stable repositories.

Practical dev impact: Upgrade first the hosts that run bypassPermissions, shell allow rules, permission hooks or unattended CI images, and check the version afterward instead of trusting an install log. Bypass mode stays a container-and-VM setting in Anthropic’s permission-modes table. I could not run a model session here, so the permission behavior comes from the changelog and the issue, not a live test.

3. A review API and a GUI driver arrive, and both can wait

GitHub’s 2 Oct changelog says you can request a Copilot code review through the supported REST and GraphQL APIs and optionally set the review effort for that request, generally available on Pro, Pro+, Max, Business and Enterprise. GitHub’s docs say the REST route is to request copilot-pull-request-reviewer[bot] as a reviewer, but neither the changelog nor the REST reference I read names the effort field, so read the schema before scripting it. The Max effort level is still marked “Coming soon”.

Computer use, announced 1 Oct, is a public preview in Copilot CLI and the Copilot app on macOS and Windows. Copilot can click, type and drag across desktop apps and asks approval first. Organization-managed settings can disable it. In the CLI, /computer on enables it, /computer show reports status and /computer off disables it.

Practical dev impact: If a script requests reviews, set an effort value only when you want something other than the Balanced default. Run /computer show on shared machines and agent hosts, and /computer off if it is on, because a tool that drives other apps is a separate approval surface from anything you set for the shell.

Practical Impact Analysis

Copilot removed model ids on a schedule announced a month ago, so the work is inventory, then policy. Decide which replacement each workflow gets and enable the policy rows that need it, with Kimi K3 the one that will not switch on by default. An individual seat may only need a picker change, but an organization seat can look broken until the policy exists.

For Claude Code the change is the version. A fleet on latest should have v2.1.288 after its next update and restart, while a fleet on stable will not until Anthropic moves that pointer, which its docs describe as typically about a week behind. If you rely on hooks as guard rails, expect some calls to be blocked that used to pass, and fix the hook rather than removing it.

Tutorial

Steps 1 to 3 are in the script below, so run the lines that match your machine. Step 4 is a policy change in Copilot settings, and step 5 is a test session.

1. See which build and channel a machine is on. claude doctor prints the running version and an Auto-update channel line.
2. If it is below v2.1.288, install that version with the line that matches how the machine got Claude Code. Native installs accept a version number and npm accepts a tag. To leave the stable channel, set autoUpdatesChannel to latest, or on Homebrew switch from the claude-code cask to claude-code@latest.
3. Search your repos for the retired Copilot names, including hyphenated model ids.
4. In Copilot settings, open the model policies, enable Gemini 3.8 Flash, Claude Opus 5.5 and, if you want it, Kimi K3, then confirm each appears in the VS Code Chat selector and on github.com. GitHub’s docs list VS Code v1.131 as the tentative minimum for Kimi K3.
5. Run one session that exercises your PreToolUse hooks. If a call is now blocked, find out why the hook could not be evaluated rather than loosening it.

#!/usr/bin/env bash
set -u

# Step 1: running version and channel
claude --version
claude doctor

# Step 2: install v2.1.288 with the line that matches your install, then confirm
curl -fsSL https://claude.ai/install.sh | bash -s 2.1.288
# npm install -g @anthropic-ai/claude-code@2.1.288
claude --version

# Step 3: retired Copilot names in this repo, including hyphenated ids
rg -n -i \
  -e 'opus[- ]4[.-]7' \

... click "Show full code" below to expand

#!/usr/bin/env bash
set -u

# Step 1: running version and channel
claude --version
claude doctor

# Step 2: install v2.1.288 with the line that matches your install, then confirm
curl -fsSL https://claude.ai/install.sh | bash -s 2.1.288
# npm install -g @anthropic-ai/claude-code@2.1.288
claude --version

# Step 3: retired Copilot names in this repo, including hyphenated ids
rg -n -i \
  -e 'opus[- ]4[.-]7' \
  -e 'gemini[- ]3[.-][56][- ]flash' \
  -e 'kimi[- ]k2[.-]7' \
  . || echo "no retired names found"

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.

I run a small engineering team on GitHub Copilot and Claude Code. On 2 Oct 2026 GitHub deprecated Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7, suggesting Gemini 3.8 Flash, Kimi K3 and Claude Opus 5.5, and Kimi K3 stays off until an admin enables it. Claude Code v2.1.288 now prompts for a dangerous rm inside bash -c or sh -c, blocks PreToolUse and PermissionRequest hooks that could not be evaluated, and sits on the latest channel while stable is still v2.1.285. Write me a one-page checklist, in order, covering what to search for in our repos, which Copilot model policies to enable and who should approve them, how to confirm the Claude Code version and channel on laptops and CI images, and how to test one guard hook after the upgrade. Name the exact command or setting for each step and the risk it avoids, and do not tell me to turn on computer use. If you need our Copilot plan, our Claude Code install method or whether we use bypass mode, ask me instead of guessing.