Application card: Copilot Code (Frontier)

What is an Application or Platform card?

Microsoft's Application and Platform cards are intended to help you understand how our AI technology works, the choices application owners can make that influence application performance and behavior, and the importance of considering the whole application, including the technology, the people, and the environment. Application cards are created for AI applications and platform cards are created for AI platform services. These resources can support the development or deployment of your own applications and can be shared with users or stakeholders impacted by them.

As part of its commitment to responsible AI, Microsoft adheres to six core principles: fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. These principles are embedded in the Responsible AI Standard, which guides teams in designing, building, and testing AI applications. Application and Platform cards play a key role in operationalizing these principles by offering transparency around capabilities, intended uses, and limitations. For further insight, readers are encouraged to explore Microsoft's Responsible AI Transparency Report and the Microsoft Enterprise AI Services Code of Conduct, which outlines how to engage with AI responsibly.

Overview

The Code tab in Microsoft Copilot is an AI-powered agent that turns what you describe into working software. You describe an outcome in natural language—a dashboard, an internal tool, a static website, a data transform, or a script—and Copilot Code builds it, shows a live preview on a canvas, and iterates with you until it works. You don't need to know how to code. Copilot Code can run on your own device (local) or in a secure, isolated environment in the cloud.

Copilot Code is designed for information workers who have ideas, data, and recurring workflows but who don't maintain a development environment. It writes and runs software on your behalf, uses your Microsoft 365 work context when you allow it, and asks for your permission before it takes actions that reach beyond the project folder you selected.

Copilot Code is available as part of Microsoft Copilot. For more information, see Copilot Code overview.

Key terms

The following table defines key terms related to Copilot Code.

Key features or capabilities

The key features and capabilities below describe what Copilot Code is designed to do.

As an agentic AI application, Copilot Code exhibits the following agentic characteristics:

• Planning: Copilot Code decomposes a natural language description into the steps needed to build the software and works through them, showing progress as it goes.
• Adaptability: You can steer Copilot Code with feedback during a session, and it adapts its approach, including reverting to an earlier version.
• Extensibility: Copilot Code's capabilities extend through plugins from the Microsoft 365 App Store, connectors to external data sources, and an optional GitHub connection.
• Memory (conversation-scoped): Within a project's conversation, Copilot Code maintains context across steps and messages. Consent granted during a session applies to that session. Context doesn't persist across separate conversations.

Intended uses

Copilot Code is designed for information workers who use Microsoft 365 and want to turn ideas, data, and recurring workflows into working software without a development environment. Some examples of use cases include:

• Dashboards and data views: Build a dashboard that tracks a metric from your data, such as weekly signups by channel.
• Internal tools: Build a tracker, form, or calculator for a team workflow, such as an inventory or approvals tracker.
• Static websites and landing pages: Build a simple site or landing page to test an idea.
• Data transforms and scripts: Turn a recurring manual process, such as rebuilding a report from several sources, into a reusable script.
• Working with existing repositories: Connect a GitHub account to ask about a repository, make a change, and open a draft pull request.

Agent scope: Copilot Code operates within the boundaries of your Microsoft 365 permissions and the project folder you select. It builds and runs software that you instruct it to create, and asks for your approval before it reaches outside the selected folder, makes a network connection, or runs a command. It doesn't take these actions without your direction or approval.

Copilot Code isn't intended for use cases that require guaranteed accuracy without human review, or for producing software for consequential or safety-critical use without appropriate testing and human oversight.

Models and training data

Copilot Code leverages AI models to power the experience that users see. You can choose from several models, including Claude Opus and Claude Sonnet variants and Claude Haiku from Anthropic, and GPT models hosted and operated by Microsoft, or let Copilot Code choose a model for you. Anthropic models are provided to Microsoft as a subprocessor. For more information, see Anthropic as a subprocessor for Microsoft Online Services and Understanding AI functionality and models in Microsoft Online Services.

Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot. In cloud mode, your organizational data remains within Microsoft 365 and is subject to your organization's existing data governance policies; however, in local mode, your data may be stored also in the local device subject to admin consent. For more information about how data is handled, see Data, Privacy, and Security for Microsoft Copilot.

Performance

Copilot Code is designed to build working software that reflects the user's intent. Performance is evaluated based on whether Copilot Code produces a functioning artifact that meets the request, and whether it iterates correctly on feedback.

Supported modalities

• Input: Text prompts from users, pasted text, and attached files (CSV, spreadsheets, images, documents, PDFs, and presentations) up to 200 MB per file. For local projects, Copilot Code can also read files in the folder you select.
• Output: A running software artifact shown on the canvas, the generated source code, files saved on your device or in the cloud, and—when you connect GitHub—branches, commits, and draft pull requests. You can share a static app as an organization-scoped link and export a project as a .zip file.

How Copilot Code processes requests

1. Copilot Code receives a natural language description of the outcome you want.
2. Copilot Code may ask clarifying questions, then plans the steps needed to build the artifact.
3. Copilot Code writes and runs the software, showing progress and a live preview on the canvas. You can switch to the code view to see the generated files.
4. Before Copilot Code accesses a location outside the selected folder, makes a network connection, or runs a command, it asks for your approval in plain language.
5. You review the result, refine it through conversation, and save, share, or export your project.

Conditions for reliable operation

• Copilot Code performs best when you describe the outcome clearly, including who the result is for and any data it should use.
• Copilot Code can only access data and services that your Microsoft 365 account is authorized to use, and, for local projects, the folder you select plus any locations you approve.
• Preview support depends on the type of artifact and your device.
• Performance might degrade for highly complex projects with many interdependencies.

Multilingual capabilities

• CCopilot Code is available in all Copilot supported languages. Support for additional languages is based on the underlying model capabilities and Microsoft 365 service availability. For more information on supported languages, see Supported languages for Microsoft Copilot.

Limitations

Understanding Copilot Code's limitations is crucial to determine if it's used within safe and effective boundaries. While we encourage customers to use Copilot Code in their innovative solutions or applications, it's important to note that Copilot Code was not designed for every possible scenario. We encourage users to refer to either the Microsoft Enterprise AI Services Code of Conduct (for organizations) or the Code of Conduct section in the Microsoft Services Agreement (for individuals) as well as the following considerations when choosing a use case:

• Instruction interpretation: Copilot Code might misinterpret ambiguous or overly broad descriptions, leading to software that doesn't match your intent. Provide clear, specific requests for better results.

• Generated code accuracy: AI-generated code and artifacts should be treated as drafts. Test what Copilot Code builds before you rely on it, share it, or use it in production. Copilot Code might produce inaccurate results, particularly when source data is incomplete or outdated.

• Project complexity: Complex projects with many dependencies might not always build as expected. Monitor progress, iterate in small steps, and revert to an earlier version when needed.

• Preview support: Preview depends on the type of artifact and your device. For example, some artifacts can't be previewed on every platform.

• Permission boundaries: Copilot Code depends on your existing Microsoft 365 permissions and the folder you select for local projects. It can't access data, services, or locations that you haven't authorized.

• Platform and device support: Copilot Code runs in the Microsoft Copilot desktop app for Windows and Mac, and on the web for cloud development. A mobile app isn't available at this release, and feature availability may vary by platform.

• Custom skills and plugins: Plugins and connectors are provided by third-party publishers and aren't validated by Microsoft. Review outputs from plugins carefully, as quality depends on who published them.

• Bias, stereotyping, and ungrounded content: Despite responsible AI controls, AI-generated content and code might still reflect biases, stereotypes, or ungrounded information. Review what Copilot Code produces before you rely on it. For more information on the known limitations of AI-generated content from Anthropic models, refer to the Anthropic subprocessor documentation.

• Potential significant physical or psychological injury to an individual: Avoid use or misuse of the system that could result in significant physical or psychological injury to an individual. For example, building software that diagnoses patients or prescribes medications has the potential to cause significant harm.

• Consequential impact on life opportunities or legal status: Avoid use or misuse of the system that could have a consequential impact on life opportunities or legal status. Examples include software that could affect an individual's legal status, legal rights, or their access to credit, education, employment, healthcare, housing, insurance, social welfare benefits, services, opportunities, or the terms on which they're provided.

Evaluations

Performance and safety evaluations assess whether Copilot Code is operating reliably and securely by examining factors like whether generated software is correct and functional while identifying the risks of generating harmful content or taking unauthorized actions. The following evaluations were conducted with safety components already in place, which are also described in Safety components and mitigations.

Performance and quality evaluations

Performance evaluations for Copilot Code are essential to improving its reliability in real-world usage. We regularly conduct performance evaluations for the following areas:

• Whether generated code is syntactically correct.
• Whether the generated artifact's functionality meets the user's request.
• The quality of the result from a user-experience perspective.

Performance and quality evaluation methods

Our evaluation data is custom-built to assess AI application performance across key areas of safety and quality, simulating real-world scenarios and risks. We begin by identifying relevant evaluation aspects of concern based on multi-disciplinary research and expert input. These concerns are translated into targeted evaluation objectives and guide formulation of evaluation metrics. For safety, we create adversarial prompts to elicit undesirable or edge-case responses, which are then scored using AI-assisted annotators trained to assess alignment with Microsoft's safety standards. For quality, we craft rubric-based prompts relevant to code-generation and agent scenarios. Datasets are curated from diverse sources including synthetic and public datasets to simulate real-world user scenarios. Using the curated datasets, both evaluations undergo iterative refinement and human alignment to improve metric efficacy and reliability.

Copilot Code was evaluated using scenarios that reflect how information workers build software, such as generating dashboards, internal tools, static sites, and data transforms. Evaluators assessed whether generated code was correct and ran, whether the artifact met the request, and whether the result held up across variations of the same task. Ideal outcomes reflect functional software that matches the request; suboptimal outcomes include code that doesn't run, missing functionality, or results that don't match intent.

Custom evaluations

In addition to standard metrics, Copilot Code was evaluated using custom metrics specific to its agentic, code-building capabilities:

• Build success (whether Copilot Code produced a functioning artifact).
• Request alignment (whether the result matches the user's intent).
• Iteration accuracy (whether Copilot Code correctly applied requested changes and reverts).

Risk and safety evaluations

Evaluating potential risks associated with AI-generated content and actions is essential for safeguarding against risks with varying degrees of severity. This includes evaluating Copilot Code's predisposition toward generating harmful content or code, and testing for vulnerabilities to jailbreak attacks and unauthorized actions. The following risk and safety evaluations were conducted:

• Hate and unfairness
• Sexual
• Violence
• Self-harm
• Protected material
• Insecure or malicious code generation
• Indirect jailbreak
• Direct jailbreak
• Unauthorized action execution

Risk and safety evaluation methods

Risk and safety evaluations used adversarial prompts and automated classifiers to assess potential harms. Tests combined LLM-judge evaluations with classifier-based detection and manual testing where needed. Additional evaluations specific to Copilot Code's execution capability tested whether the agent could be manipulated into generating insecure code or taking actions—accessing files, making network connections, or running commands—without the required consent. Ideal results redirect or decline unsafe requests and keep the consent boundary intact across prompt variations. Suboptimal results include producing harmful or insecure content, or taking actions without proper approval.

Safety components and mitigations

As we identified potential risks and misuse through processes like red team testing and measured them, we developed mitigations to reduce the potential for harm. The following list describes some of those mitigations. We continue to evaluate Copilot Code to improve product performance and mitigations.

• Consent for actions that reach beyond the project folder. Copilot Code's primary safety mechanism is its consent model. When you select a folder to work in, Copilot Code can read and write within that folder; accessing any other location, making a network connection, or running a command requires your explicit approval. Consent prompts are written in plain language.

• Configurable isolation for code execution. Copilot Code runs generated software with configurable isolation and enforcement levels. Administrators can configure the enforcement level for their organization.

• Permission boundaries. Copilot Code operates strictly within your existing Microsoft 365 permissions and the folder you select. It can't access data, services, or resources that you haven't authorized, which helps prevent privilege escalation.

• Conversation-scoped consent. Consent you grant during a session applies to that session and doesn't persist across separate conversations, limiting the blast radius of any unintended permission grant.

• AI-based classifiers and content filtering. Copilot Code uses AI-based classifiers and content filters to identify and block potentially harmful content in user prompts and generated responses, including filters for hate speech, violence, sexual content, self-harm, and protected material.

• Metaprompting. System instructions guide Copilot Code's behavior to align with Microsoft's AI Principles and user expectations, including instructions to decline inappropriate requests and to avoid generating insecure or malicious code.

• User-centered design and transparency. Copilot Code shows each step as it works and displays a live preview, making the agent's actions transparent so you can identify when it's heading in an unintended direction.

• Auditability. Copilot Code logs the actions it takes—code generated, commands run, and files read or written—and these logs are available to IT administrators, providing traceability from a user's request to the action and its outcome.

• Administrative controls. Administrators can enable or disable Copilot Code and specific features, enforce policy at the organization level, restrict GitHub account connections, and set per-user spend limits. Usage is metered against your Microsoft Copilot entitlement.

• Feedback mechanisms. Users can submit thumbs up or thumbs down feedback, with a comment on thumbs down, which is used to evaluate and improve Copilot Code's quality and safety.

• Cybersecurity measures. Copilot Code implements cybersecurity practices including encrypted data transmission, secure authentication through Microsoft Entra ID, and adherence to Microsoft's security development lifecycle. In cloud mode, your organizational data remains within Microsoft 365 and is subject to your organization's existing data governance policies; however, in local mode, your data may be stored also in the local device subject to admin consent. Regular security audits and threat model reviews are conducted to identify and address potential vulnerabilities.

Best practices for deploying and adopting Copilot Code

Responsible AI is a shared commitment between Microsoft and its customers. While Microsoft builds AI applications and platform services with safety, fairness, and transparency at the core, customers play a critical role in deploying and using these technologies responsibly within their own contexts. To support this partnership, we offer the following best practices for deployers and end users to help customers implement responsible AI effectively.

Deployers and end users should:

• Exercise caution and evaluate outcomes when using Copilot Code for consequential decisions or in sensitive domains. Consequential decisions are those that may have a legal or significant impact on a person's access to education, employment, financial platforms, government benefits, healthcare, housing, insurance, legal platforms, or that could result in physical, psychological, or financial harm. Sensitive domains—such as financial platforms, healthcare, and housing—require particular care due to the potential for disproportionate impact on different groups of people. When using AI for decisions in these areas, make sure that impacted stakeholders can understand how decisions are made, appeal decisions, and update any relevant input data.

• Evaluate legal and regulatory considerations. Customers need to evaluate potential specific legal and regulatory obligations when using any AI platforms and solutions, which may not be appropriate for use in every industry or scenario. Additionally, AI platforms or solutions are not designed for and may not be used in ways prohibited in applicable terms of service and relevant codes of conduct.

Deployers should:

• Configure access and controls appropriately. Use the available administrative controls to manage which users can access Copilot Code, which features are available, GitHub connection restrictions, and per-user spend limits. Consider starting with a pilot group before broader deployment.

• Educate users on the consent model. Ensure users understand that they are responsible for reviewing and approving what Copilot Code accesses, connects to, and runs, and that AI-generated code should be treated as a draft to test before use.

• Review plugin usage. Evaluate plugins before making them available. Understand what data each plugin accesses and what actions it can perform.

• Monitor usage, audit logs, and feedback. Review audit logs and user feedback to identify patterns, common issues, or areas where additional guidance might be needed.

End users should:

• Exercise human oversight when appropriate. Human oversight is an important safeguard when interacting with AI applications. While we continuously improve our AI applications, AI might still make mistakes. The outputs generated may be inaccurate, incomplete, biased, misaligned, or irrelevant to your intended goals. As such, review and test what Copilot Code builds and verify that it matches your expectations and requirements.

• Be aware of the risk of overreliance. Overreliance on AI happens when users accept incorrect or incomplete AI outputs, mainly because mistakes may be hard to detect. For code and software, this is especially important—test what Copilot Code builds before you rely on it, share it, or use it in production.

• Exercise caution when using Code in sensitive domains. Take additional precautions when building software whose actions are irreversible or highly consequential, as described further in either the Microsoft Enterprise AI Services Code of Conduct (for organizations) or the Code of Conduct section in the Microsoft Services Agreement (for individuals).

• Provide clear, specific instructions. Include details about the outcome you want, who it's for, and any data it should use. The more specific the instruction, the better the result.

• Review consent prompts carefully. Before you approve access to a location, a network connection, or a command, make sure you understand and intend it.

• Provide feedback regularly. Use the thumbs up/down buttons and comments to help improve Copilot Code's performance over time.

Learn more about Copilot Code

For additional guidance or to learn more about the responsible use of Copilot Code, we recommend reviewing the following documentation:

• Copilot Code overview
• Get started with Copilot Code
• Use Copilot Code

Learn more about responsible AI

• Microsoft AI principles
• Microsoft responsible AI resources