A cheaper small model, an enforceable agent sandbox, and a new meter on secret scanning.
- Anthropic prices Claude Haiku 5.5 at a tenth of Haiku 4.5 up to 100,000 tokens, and at half above that.
- GitHub says local sandboxing for Copilot is generally available, and an enterprise can require it.
- GitHub’s secret-detection model is live for alerts, and the opt-in push-time checks will draw AI Credits.
Security
GitHub’s secret-detection model is live for alerts, and the opt-in checks will draw AI Credits
GitHub’s changelog of 7 October says a fine-tuned model now reads surrounding code to find likely credentials, including passwords with no recognizable token format. Customers with AI-detected Password alerts were upgraded automatically, and GitHub says those alert scans stay included in Secret Protection and Advanced Security at no extra charge. The two opt-in checks are different: AI-detected secrets in push protection is in private preview, and AI-based secret scanning in the Copilot /security-review command is coming soon in private preview. GitHub says AI Credit usage for both will be introduced in the coming weeks under a Secret Protection AI Credits SKU, that a check can consume credits even when it does not block a push, and that budget alerts alone do not stop usage. It hits organizations already using AI push protection in the preview, because GitHub says continued use after the billing change takes effect will consume credits.
This week. If anyone has AI push protection turned on from the private preview, decide whether to keep it before billing starts. Create a budget for the Secret Protection AI Credits SKU with “Stop usage when budget limit is reached” enabled before you opt in anywhere else.
AI
Claude Haiku 5.5 costs a tenth of Haiku 4.5 on short prompts, and the price steps up above 100,000 tokens
Anthropic announced Claude Haiku 5.5 on 7 October, with the model ID claude-haiku-5-5. For prompts up to 100,000 tokens it lists $0.10 per million input tokens and $0.50 per million output tokens, against $1 and $5 for Haiku 4.5. Above 100,000 tokens the rates are $0.50 input and $2.50 output, five times the lower tier. Anthropic says the model uses an updated tokenizer and so uses slightly more tokens per task, and that it is best for narrowly scoped work such as compaction, summarization, and subagents, while Sonnet 5.5 and Opus 5.5 remain better for complex agentic coding. GitHub says the model is generally available in Copilot, rolling out gradually, and enabled by default for Business and Enterprise unless an administrator disables it. It hits high-volume workloads with a mix of short and long prompts, and Copilot administrators.
This week. Before moving a high-volume workload to claude-haiku-5-5, measure your real prompt-length distribution, rerun cost with the new tokenizer, and route any prompt that can pass 100,000 tokens to another model or trim it. Keep complex coding agents on Sonnet 5.5 or Opus 5.5, and check whether your Copilot administrators want the model on by default.
Platforms
Local sandboxing for Copilot is generally available, and an enterprise can require it
GitHub’s changelog of 7 October says local sandboxing is generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host. GitHub says commands and tools Copilot starts run with restricted access to the filesystem, network, credentials, and other system capabilities, under policies set by the developer or organization. The policies can limit the files and directories agent-run commands can read or modify, and control access to the internet, local networks, Git credentials, and GitHub CLI credentials. GitHub says they apply to local tools including local MCP and language servers where supported, that enterprise-managed settings can require sandboxing in a way developers cannot weaken, and that it is included with Copilot at no additional cost. It hits any team where developers run Copilot agents on their own machines.
This week. Write down which paths, hosts, and credentials a Copilot agent session needs, start from deny, and test that policy in one team’s Copilot CLI before an enterprise-managed setting makes sandboxing mandatory. Check that your local MCP servers still start under it.
Leave a Reply