Melbourne-based developer Zach Manson asked Copilot to fix a typo in a pull request. It fixed the typo. It also rewrote the PR description to include an advertisement for Raycast, a macOS productivity tool with a Copilot integration. The promotional line read: “Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.”
Manson’s reaction: “This is horrific.”
A search across GitHub found the same phrase embedded in over 11,000 pull requests across thousands of repositories. Broader estimates put the total number of PRs affected at over 1.5 million. The promotional text was not limited to the Raycast plug. Other injected “tips” pushed Slack and Teams integrations, VS Code, JetBrains IDEs, and Eclipse. Every variant was tagged with a hidden HTML comment in the PR markdown: `START COPILOT CODING AGENT TIPS`.
The ads hit GitLab merge requests too. If Copilot touched your PR anywhere, the tip followed.
Martin Woodward, GitHub’s Vice President of Developer Relations, confirmed the behavior and said the feature has been disabled. His explanation: the product tips were “kinda ok on Copilot originated PR’s but then when we added the ability to have Copilot work on _any_ PR by mentioning it the behaviour became icky.” He said product tips are now disabled entirely thanks to feedback.
Two things about that response. First, “icky” is doing a lot of heavy lifting for a VP describing an AI tool that silently modified developer work product to promote commercial integrations. Second, the framing admits that GitHub considered injecting promotional text into AI-generated pull requests acceptable in the first place. The line between “ok” and “icky” was not the advertising itself. It was the radius. They only pulled back because it spread to PRs Copilot did not originate.
That distinction matters because it tells you what the default position was: promotional injection is fine as long as it stays inside the content the AI created.
Pull requests are one of the most trusted artifacts in software development. They represent proposed changes to a codebase. They get reviewed by humans who are making decisions about what ships to production. They carry legal and compliance weight in regulated industries. When an AI tool silently appends commercial messaging to a PR description, it is modifying a document that developers treat as a source of truth. The fact that the modification was a “tip” rather than a banner ad does not make it less of an integrity violation.
And it sits inside a pattern that Microsoft has been running for years. Windows 11 shoves ads into the Start menu. Edge intercepts browser downloads with pop-up surveys asking users why they want to leave. Copilot inserts promotional messages into the Windows desktop. The throughline is simple: Microsoft treats every surface it controls as an advertising channel. GitHub was not going to be an exception. The only question was when.
The timing makes it worse. On March 25, GitHub announced that starting April 24, 2026, interaction data from Copilot Free, Pro, and Pro+ users will be used to train AI models by default. The announcement post collected 97 thumbs-down reactions against 4 supportive ones. Users are calling it “forced authorization.” GitHub is shifting from opt-in to opt-out while simultaneously dealing with the fallout of its AI tool injecting ads into developer workflows.
So GitHub is now running a two-front trust erosion campaign: using your code interactions to train models you did not consent to improve, and using the AI agent you pay for to advertise other products back to you inside your own repositories. Both happened in the same week.
The security implications are not hypothetical either. In October 2025, researchers demonstrated that hidden instructions embedded in PR comments and metadata could manipulate Copilot into leaking sensitive data from private repos. The attack used hidden HTML elements to exfiltrate AWS keys through Copilot’s rendering pipeline. GitHub’s own “tips” mechanism used the same vector: hidden HTML comments in PR descriptions. When the platform itself normalizes embedding hidden content in pull requests, it lowers the bar for everyone else who wants to do the same thing for less benign purposes.
Woodward says the tips are off. Fine. But the infrastructure that enabled them still exists. The decision-making culture that approved them still exists. The business model that incentivized them still exists. Microsoft spent $13 billion on OpenAI and 15 million developers now use Copilot. That is not a tool. That is a distribution channel. And distribution channels get monetized.
The next time Copilot adds something to your pull request, you should probably read it twice. And check the HTML.