AI Assistants in the IDE: Copilot Agent Mode, Rider AI and Safe Use

Version note: The code in this post was built and run with .NET 10 SDK (Software Development Kit) 10.0.402 and xUnit 2.9.3. The AI (Artificial Intelligence) features of Visual Studio 2026 (18.11), Visual Studio Code (VS Code) 1.145 and Rider 2026.2 were not run for this post; the description comes from the official release notes, documentation and release announcements as of November 8, 2026. Date note: this is the fastest-aging post in the series; feature names and "preview" labels change every month, so if you read it after publication, verify against the release notes.

Guess First

You tell an AI agent "write xUnit tests for DiscountService, and test that half cents are rounded up" for Bookstore's discount service. The agent writes five tests, its explanation is convincing, the diff looks clean. One of the tests ends with this line:

Assert.Equal(Math.Round(expected, 2, MidpointRounding.HalfUp), discount);

Do you think this test compiles? If it does, does it pass? And does the Math.Round(price * rate, 2) in the implementation the agent wrote in the same session follow the business rule? The answers are in the middle of the post, with real compiler and test output.

Four Levels: Completion, Next Edit Suggestions, Chat, Agent

AI help in the IDE (Integrated Development Environment) is not one thing; it has four levels, and at each level control moves a little further away from you. Inline completion suggests the next few lines where the cursor is; if you don't press Tab, nothing happens. Next edit suggestions (NES) look at the change you just made and suggest the next edit you need somewhere else in the file; Visual Studio 18.7 brought long-distance NES (suggestions far away in the file) as an option that is off by default. Chat (Ask) answers questions and suggests code but doesn't touch files itself. Agent mode takes a goal, reads and changes files, runs commands in the terminal, looks at build and test results and tries again.

The practical consequence of this distinction: the higher the level, the heavier the review. You see completion line by line; you see an agent's ten-file change only by reading the diff. How much autonomy you give the agent, that is, whether it asks for approval on every command, is set by the IDEs' permission settings; that is why VS Code 1.111 introduced agent permission levels and Autopilot (preview), which iterates on its own until the task is done, as separate settings.

Visual Studio 2026: Agent, Copilot SDK, BYOK, Debugger and Profiler Agents

Visual Studio's AI side changed almost every month across the 18.x line. From the release notes, the items that matter to a .NET developer:

• 18.0 (November 2025): the Debugger Agent for unit tests and the Profiler Agent for CPU (Central Processing Unit) and allocation analysis, invoked with @profiler in Copilot Chat.
• 18.4 (March 2026): custom agents in .agent.md files, the find_symbol tool that finds symbols for agent mode, and administrator allowlists for enterprise MCP (Model Context Protocol) governance.
• 18.5 (April 2026): agent skills discovered automatically from the .github/skills/, .claude/skills/ and .agents/skills/ folders, and a Debugger Agent that reproduces the bug, instruments it with tracepoints and validates the fix at runtime.
• 18.7 (June 2026): MCP server trust validation; it asks for re-approval when an MCP server's configuration or files change, on by default.
• 18.8 (July 2026): Agent (Preview), built on the same GitHub Copilot SDK as the Copilot CLI (Command Line Interface), chosen from the agent picker.
• 18.10 (September 2026): BYOK (Bring Your Own Key, preview); using your own model key with Microsoft Foundry, OpenAI, Anthropic, Ollama and custom endpoints. The release notes list as a breaking change that the earlier BYOK experience in Ask and Agent mode is no longer supported.
• 18.11 (October 2026): a new Copilot chat experience built on the Copilot SDK, opt-in under Tools > Options > GitHub > Copilot > Copilot Chat and requiring a restart.

How the Debugger and Profiler Agents relate to debugger and profiler features is covered in the fifth post of the Debugging series and the upcoming Profiling series; what matters here is that these agents can use the IDE's tools (breakpoints, tracepoints, profiler sessions) on their own. That power also enlarges the review responsibility.

VS Code: Agent Sessions, Harnesses and Automations

In 2026 VS Code turned from an editor into an agent workspace. With 1.120 (May 13, 2026) the Agents window reached the Stable channel: you manage agent sessions across all projects in one window. With 1.130 the agent host started running sessions in a separate process that you can connect to from multiple VS Code windows. In 1.145 on November 4, 2026, nested sessions can use different harnesses (preview): you can have Claude review a plan Copilot wrote within the same session, or give the same task to Codex and compare side by side; each nested session has its own model, agent and permission level. In the same release automations became schedulable with cron expressions, and how much detail the agent shows became configurable.

On the .NET side the agent works with C# Dev Kit's language server and the dotnet CLI; on the Angular side it can see the content and console errors of the page it opens in the integrated browser. Being able to use the Dev Container from the sixth post as the isolation boundary for agent sessions (1.140) is an important step for security: the commands the agent runs execute in the container, not on your host machine.

Rider: AI Chat, Junie, Built-in Copilot and .NET Agent Skills

JetBrains' approach is not to tie itself to a single agent. The agent picker in Rider's AI chat has JetBrains' own coding agent Junie, agents added through the ACP (Agent Client Protocol) Registry and, since 2026.2 as a result of a partnership with Microsoft, GitHub Copilot built in; Copilot needs no ACP setup, just an active Copilot subscription. On the AI completion side, next to JetBrains' own trained models, 2026.2 can connect OpenAI-compatible endpoints running locally, such as llama.cpp.

The real difference in 2026.2 is connecting agents to the IDE's intelligence: bundled skills such as finding-tests, which uses dotCover data to find where a test should go, and dottrace-analyze, which reads a dotTrace snapshot; Microsoft's official .NET, Aspire and Azure skills discoverable and installable from the IDE; and quality-check hooks for Claude Code that validate every change and stop the agent from finishing while there are compilation errors. Skills are under Settings > Tools > AI Assistant > Skills, hooks under Tools > AI Agent Hooks. The AI Agent Setup widget that came to the status bar with 2026.2.2 shows in one place which of these features are on. ReSharper 2026.2 also started ACP-based agent support inside Visual Studio with a preview of Junie.

Instructions in the Repo: copilot-instructions.md, Skills and MCP Trust

The way for the agent to know the team's rules is to write the rules into the repo. Visual Studio and VS Code add the repo's .github/copilot-instructions.md file to the context of every request; the /generateInstructions command that arrived in Visual Studio 18.3 produces a draft of this file. A short, auditable example for Bookstore:

# Bookstore coding instructions

- Target .NET 10 and C# 14. Use file-scoped namespaces, primary constructors and collection expressions.
- Money is always decimal. Round to 2 digits with MidpointRounding.AwayFromZero.
- Tests use xUnit. One behavior per test; name tests Method_condition_result.
- Never add a NuGet package without asking. Never read or print files under secrets/ or *.pfx.
- Run `dotnet build` and `dotnet test` before saying a task is done.

An instruction file is a request, not a security control. Writing "don't touch the secrets folder" doesn't mean the agent can't access it; that is why the safe-use rules below are needed separately. The same logic applies to skills and MCP servers: a skill or an MCP server adds new tools and instructions to the agent; the extension security rules from the eighth post apply here one to one. Visual Studio's MCP trust validation in 18.7 is a safeguard against a server you approved changing silently. Writing an MCP server is the subject of the upcoming AI Agents and MCP series.

The Compiler Catches the Invented API, a Test Catches the Wrong Behavior

Back to Guess First. The test file the agent wrote:

[Theory]
[InlineData(100.00, 0, 0.00)]
[InlineData(100.00, 2, 5.00)]
[InlineData(100.00, 5, 10.00)]
[InlineData(10.25, 5, 1.03)]
public void LoyaltyDiscount_rounds_half_away_from_zero(decimal price, int years, decimal expected)
{
    decimal discount = _service.LoyaltyDiscount(price, years);

    Assert.Equal(Math.Round(expected, 2, MidpointRounding.HalfUp), discount);
}

$ dotnet test tests/Bookstore.Pricing.Tests
./tests/Bookstore.Pricing.Tests/DiscountServiceTests.cs(16,63): error CS0117: 'MidpointRounding' does not contain a definition for 'HalfUp'

The first answer: it doesn't compile. HalfUp doesn't exist in .NET; it is a plausible-looking, invented API (Application Programming Interface) that feels familiar from Java's RoundingMode.HALF_UP. The good thing about this kind of error is that the compiler catches it immediately; that is why telling the agent "build before you finish" (exactly what Rider 2026.2's hook enforces) is the cheapest safety net. We fixed the test line to Assert.Equal(expected, discount) and ran the tests:

[xUnit.net 00:00:00.06]     Bookstore.Pricing.Tests.DiscountServiceTests.LoyaltyDiscount_rounds_half_away_from_zero(price: 10.25, years: 5, expected: 1.03) [FAIL]
  Failed Bookstore.Pricing.Tests.DiscountServiceTests.LoyaltyDiscount_rounds_half_away_from_zero(price: 10.25, years: 5, expected: 1.03) [< 1 ms]
  Error Message:
   Assert.Equal() Failure: Values differ
Expected: 1.03
Actual:   1.02
Failed!  - Failed:     1, Passed:     4, Skipped:     0, Total:     5, Duration: 9 ms - Bookstore.Pricing.Tests.dll (net10.0)

The second answer: the implementation doesn't follow the business rule. Math.Round(decimal, int) uses MidpointRounding.ToEven by default (banker's rounding); 1.025, which is 10 percent of 10.25, is rounded to the even 1.02. The business rule is to round half a cent up:

return Math.Round(price * rate, 2, MidpointRounding.AwayFromZero);

Passed!  - Failed:     0, Passed:     5, Skipped:     0, Total:     5, Duration: 7 ms - Bookstore.Pricing.Tests.dll (net10.0)

The lesson has two layers. The compiler catches the invented API, but only a test that knows the business rule catches wrong behavior that compiles. If the agent writes both the implementation and the test, both can share the same wrong assumption; that is why it matters that you choose the boundary value (such as 1.025) in the test.

Safe Use: Diffs, Secrets, Policy and Licensing

Review the diff line by line. The diff is the truth, not the agent's explanation; look especially at deleted tests, loosened assertions, added packages and changed configuration. Visual Studio 18.6's multi-file summary diff view and per-chunk accept/undo exist for this job.

Keep secrets out of the context. A real connection string in appsettings.Development.json, an open .env file or a token in terminal output becomes part of the context the agent reads. According to GitHub's documentation, Copilot Business and Enterprise can exclude specific files with content exclusion, supported for chat and agent in Visual Studio, VS Code and JetBrains IDEs; but the same documentation says plainly that this is not a file system security boundary and that agents may not always detect indirect file access. The real safeguard is not keeping secrets in plain files on the development machine.

Organization policy and licensing. Which model is reached, with which data, through which plan is a legal and compliance matter; using your own key with BYOK changes where your code goes. Policies in the enterprise plans of Copilot and JetBrains AI (model choice, public code matching, data retention) are set by the administrator; an individual developer saying "it's enabled for me" is not enough.

The method of working with AI, writing prompts and splitting tasks is the subject of the AI-Assisted Development series in the Artificial Intelligence category; this post covers only the tools in the IDE and the security frame.

In Production

Isolate the agent. Running an agent that can execute commands in a Dev Container, a separate worktree or an environment with restricted permissions limits the damage of a wrong rm or a wrong migration.

Watch the cost. Visual Studio 18.8 added usage tracking and alerts for token-based billing; agent sessions consume far more tokens than completion. Manage long agent sessions with budgets and limits.

Track versions. A large part of the features in this post are in preview; their name, location or default may change next month. Keep an "AI tools" page for the team and note which feature is enabled in which version.

Common Pitfalls

Assuming that if it compiles, it is correct. Real output: the compiler caught the invented HalfUp, only a test caught banker's rounding.

Having the same agent write the test and the implementation in the same session and accepting both. The same wrong assumption gets into both sides; at least choose the boundary values yourself.

Treating the instruction file as a security control. copilot-instructions.md is a request; access control lives in the operating system, content exclusion and isolation.

Seeing MCP servers and skills as different from extensions. All of them are code that adds new capabilities and new instructions to the agent and runs with your permissions; they need the same review.

Making a preview feature part of a production workflow. Its behavior may change in the next update; read the breaking change lines in the release notes (like the BYOK change in 18.10).

A Small Experiment

★☆☆ Add a five-line .github/copilot-instructions.md like the one in this post to your repo and ask the agent for a small change. Which instructions did it follow, and which not?

★★☆ Pick a service in your own project and have an agent write its tests. Before running the tests, read the diff and note the lines you suspect; then compare with the build and test output. List separately the problems the compiler caught, the ones the tests caught, and the ones neither caught.

★★★ Give the same task to two different harnesses or agents (with VS Code 1.145's nested sessions or Rider's agent picker) and compare the results: the number of files changed, packages added, whether the tests pass, the time spent.

AI features are the fastest-changing area, but not the only one changing. In the last post of the series we look back: from Visual Studio 2022 to 2026, what Rider and VS Code brought in 2025 and 2026, and a checklist for moving to .NET 11.