Summary
Across its July 2026 releases, GitHub Copilot CLI tightened agent safety: v1.0.70 (July 9) added configurable subagent concurrency and depth limits plus preToolUse hooks that deny tool calls by exiting with code 2, and v1.0.71 (mid-July) made Plan Mode read-only so planning can no longer edit files, enforced the sandbox filesystem policy on LSP reads and rename edits, and let users limit which built-in agents are available to tasks and subagents. The v1.0.71 release also added persistent /voice devices selection and canvas support in the terminal.
What changed
GitHub Copilot CLI v1.0.70 (July 9, 2026) added subagent concurrency and depth limits in /settings and preToolUse hooks that deny tool calls on exit code 2; v1.0.71 (mid-July 2026) made Plan Mode read-only so it can no longer edit files during planning, enforced the sandbox filesystem policy on LSP file reads and rename edits, added controls to limit which built-in agents tasks and subagents can use, and brought /voice device persistence and canvas support into the CLI.
Why it matters
As Copilot CLI leans into multi-agent, filesystem-capable workflows, uncontrolled subagent spawning, unguarded tool calls, and a planning agent that can silently edit files are real operational and security risks. Phase-scoped, least-privilege controls -- read-only planning, bounded subagent depth, pre-tool gating, and per-task agent limits -- give teams guardrails to bound an agent's blast radius, a maturing pattern for running autonomous coding agents in production.
Evidence excerpt
Plan Mode can no longer edit files ... enforced the sandbox filesystem policy on LSP file reads and rename edits; /voice devices to choose and persist the microphone; limit which built-in agents are available to tasks and subagents.