Microsoft Copilot Is Eighty Products of Pure Chaos

This is not another article written by someone who believes artificial intelligence is an evil electronic demon sent to steal his calculator, corrupt Linux and replace every developer with a glowing server rack. AI is a useful tool. It can speed up boring work, explain unfamiliar code, generate basic functions, find mistakes and help turn ideas into working software.

But liking AI does not mean I have to bend over and lovingly applaud every pile of shit with an AI sticker on it.

About a year ago, I used GitHub Copilot while building several WordPress plugins. The plugins worked. They did what they were supposed to do, and at the time I was reasonably happy with them.

Now I am returning to those plugins. Some of the code is not written particularly well. Some parts need serious restructuring. A few plugins would probably be easier to rebuild from scratch than carefully untangle, understand and repair. Excellent.

Copilot saved me time a year ago, then carefully stored that time inside the code so I could spend it later, with interest. Of course, I accepted the generated code. I tested it, used it and ultimately took responsibility for it. I am not blaming a chatbot because I pressed the Accept button. However, this experience perfectly demonstrates what sucks about Copilot. It can make you feel incredibly productive while quietly creating tomorrow’s work.

Before we even reach the code, however, we need to discuss Microsoft’s absolutely stupid approach to marketing.

1. Everything Is Copilot So Copilot Means Nothing

Copilot was once a reasonably clever product name. A copilot assists the pilot. It does not fly the entire plane, make every decision or throw the pilot out through the emergency exit. The name suggested an assistant working beside you. Fine. Sensible. Somebody in marketing briefly experienced competence.

Then Microsoft did what Microsoft does best. It took one reasonably good name and smeared it across everything it could find.

Microsoft Copilot. Microsoft 365 Copilot. Microsoft 365 Copilot Chat. GitHub Copilot. Microsoft Security Copilot. Copilot Studio. Copilot for Sales. Copilot for Service. Copilot for Finance. Gaming Copilot. Dragon Copilot. Copilot+ PCs. Copilot agents. Copilot features inside other Copilot products.

There is even a platform for building more Copilots, because apparently the infestation was not spreading quickly enough naturally.

An independent researcher attempted to map every Microsoft product, application, feature, service and piece of hardware carrying the Copilot name. By 9 April 2026, the count had reached 81! He also found that Microsoft did not provide one definitive public list covering the entire collection.

That does not mean Microsoft sells 81 completely separate Copilot subscriptions. Some are applications, features, platforms, hardware branding or tools living inside other tools.

That is almost worse.

There are Copilots inside Copilots, Copilots for building other Copilots and a physical Copilot key for summoning whichever Copilot happens to answer the door. That is not a product family. It is branding diarrhoea.

A product name should help customers identify something. Photoshop identifies an image editor. WordPress identifies a content management system. Firefox identifies a browser.

Copilot identifies something from Microsoft containing AI. Maybe. It could be a consumer chatbot. It could be a coding assistant. It could be an enterprise product. It could be part of Microsoft 365. It could be a security service. It could be a feature inside Windows. It could be a button on your keyboard that launches something you never asked for.

At this point, Copilot is not a useful product name. It is a corporate sticker applied by marketing losers who ran out of ideas.

2. Microsoft Needs a Copilot to Explain Which Copilot You Need

When customers cannot understand your product range, you have failed at one of the most basic jobs in marketing. Marketing is not merely shouting the same product name repeatedly until everyone becomes numb. It is supposed to explain what the product is, who it is for and why somebody should use it.

Microsoft now maintains an official page called Decide which Copilot is right for you.

The page explains the differences between Microsoft 365 Copilot Chat, Microsoft 365 Copilot, Microsoft Copilot, Microsoft Security Copilot, GitHub Copilot and Copilot Studio.

It even says that the page can help end users who already have Copilot installed but are not sure which Copilot they have.

Read that again.

You may already have Copilot, but need Microsoft documentation to identify which Copilot has entered your computer.

For individual customers, Microsoft separately compares its consumer Copilot and Microsoft 365 subscription options. GitHub Copilot then has its own completely different plans, models, features, credits and limitations.

So first you must determine whether you need Microsoft Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Chat or GitHub Copilot.

Then you must determine which plan of that Copilot you need.

Then you must inspect which models, usage limits, agents and credits are included.

Perhaps Microsoft should release Copilot for Choosing Copilot.

You would open it and type: I am a web developer who wants help with PHP and WordPress. Which Copilot do I need? It would think for twenty seconds, display a spinning rainbow, consume some AI credits and recommend Microsoft Security Copilot for Enterprise Sales Dragon Gaming Studio Premium+.

Even the US National Advertising Division found that Microsoft’s broad use of the Copilot description could leave customers unable to understand differences between Business Chat and Copilot features inside particular Microsoft 365 applications.

It recommended that Microsoft clarify limitations in its advertising. Microsoft disagreed with parts of the decision but said it would follow the recommendations. When an advertising watchdog has to examine whether customers can understand what your product actually does, perhaps the marketing strategy is shit.

The final responsibility belongs to Microsoft chairman and CEO Satya Nadella. He probably did not personally sit in a meeting demanding that a keyboard button, a coding assistant, an office chatbot, a security platform and half the company should all receive the same name.

Microsoft employs marketing executives for that particular form of intellectual vandalism. But Copilot became one of Microsoft’s central AI brands under Nadella, and the executive now leading the unified Copilot experience across consumer and commercial products reports directly to him. At some point, “I did not personally name every product” stops being an explanation and becomes a very expensive version of “not my department.”

3. It Produces Code Quickly Which Is Not the Same as Producing Good Code

Copilot is excellent at producing code. That sentence is deliberately incomplete.

Producing code is easy. Producing code that works today, remains understandable next year, follows the project architecture, handles unusual situations, stays secure and can be extended without causing a nervous breakdown is the actual job.

Copilot can generate twenty functions before you have finished your coffee. That looks wonderfully productive in a demonstration. Look at all the code appearing on the screen. Look how quickly the feature exists. Look how the little numbers in the productivity chart rise towards heaven.

Now return to the project a year later.

Why is this function duplicated? Why does this class know about five unrelated things? Why is the same option sanitised in three different ways? Why does this AJAX handler perform a capability check while the other one apparently believes every logged-in user is the administrator? Why is there a custom database query for something WordPress already provides? Why does changing one setting break another screen?

Copilot does not have to maintain the result. You do.

A 2025 research preprint examining open-source projects found increased development activity following Copilot adoption, particularly among less-experienced contributors.

However, it also found that submitted code required more rework. Experienced core developers reviewed 6.5% more code while their own original coding activity fell by 19%. The researchers warned that visible productivity gains could conceal increased technical debt and a growing maintenance burden.

This is a research preprint, not the final word of God delivered on a stone tablet. It does, however, describe a very believable pattern. Everybody produces more code. Then the people who understand the system spend their time cleaning it. A triumph.

4. Copilot’s Mistakes Wear a Suit

Bad code written by a beginner often looks bad. Variables have strange names. Logic is duplicated. Formatting is inconsistent. Half the function is copied from an unrelated Stack Overflow answer involving a shopping basket from 2013.

Copilot’s bad code is more sophisticated. It is neat. It is formatted. The variable names sound reasonable. There may even be comments politely explaining what the incorrect code is supposed to do. That makes it more dangerous.

A syntax error is honest. It refuses to run and points towards the problem.

Copilot can produce code that runs beautifully while misunderstanding the requirement, ignoring an edge case or implementing something subtly different from what you requested.

GitHub’s own guidance tells developers to look for hallucinated APIs, ignored constraints, incorrect logic and code that appears right while failing to match the developer’s actual intention. It recommends verifying architecture, functionality, security, dependencies and tests before accepting AI-generated code.

That is sensible advice, but it also reveals the central joke.

Copilot writes the code quickly, and then you must carefully inspect every part because it may be confidently wrong. That is not necessarily faster. Sometimes it is simply a different way to spend the same time.

Instead of writing the function yourself, you become an editor reviewing the work of an extremely fast junior developer who has read half the internet, remembers it imperfectly and is physically incapable of admitting uncertainty.

5. It Understands the Function Not Necessarily the Fucking Project

A WordPress plugin is not merely the PHP file currently open in the editor. It might contain admin pages, front-end output, REST endpoints, AJAX handlers, scheduled events, database options, WooCommerce hooks, JavaScript, CSS, translation files and uninstall routines. It may interact with caching plugins, multilingual plugins, payment gateways and whatever other fascinating collection of software the client installed at three in the morning.

A locally sensible change can break something elsewhere.

Copilot may understand the function you showed it while missing the architecture around it. Every model has a limited context window. GitHub documents that long Copilot CLI conversations may be compressed into summaries once the available context begins filling up.

GitHub also admits that exact wording, full command output and smaller decisions from earlier in the conversation may not survive that summarisation. So Copilot can forget decisions made earlier, overlook a related file or introduce a new pattern despite the project already using a different one.

You tell it:

Use the existing helper function for sanitisation. It agrees enthusiastically.

Three messages later, it creates another helper function with nearly the same name.

You now have:

sanitize_plugin_value()
plugin_sanitize_value()
clean_plugin_setting()

All three work slightly differently. Copilot has not reduced your project’s complexity. It has started a small family of functions and left you to raise them.

6. It May Notice a Typo While Missing the Security Hole

WordPress plugin security is not decorative. Input must be validated and sanitised. Output must be escaped. Sensitive actions need capability checks. Requests may require proper nonce handling. Database operations must be handled safely.

WordPress explicitly warns that nonces must never be treated as authentication, authorisation or access control. Sensitive actions should also be protected with capability checks such as current_user_can().

Copilot can help with these things, but trusting it blindly would be idiotic. A 2025 research preprint tested GitHub Copilot’s code-review feature against several intentionally vulnerable codebases.

Across seven benchmark datasets containing hundreds of documented vulnerabilities, Copilot produced fewer than twenty comments. Many concerned spelling or minor style issues, while serious vulnerabilities such as SQL injection, cross-site scripting and insecure deserialisation were missed.

Again, this tested a particular version and setup. It does not prove that every current Copilot review will miss every security problem.

It proves that treating an AI code review as a security audit would be spectacularly stupid. The attacker may be able to access private data, but at least Copilot corrected “seperate” to “separate”. This is particularly relevant to WordPress.

Copilot may generate a settings form containing a nonce, giving the code the healthy appearance of security. But a nonce does not prove that the current user has permission to perform the action.

The code can look secure, contain security-related functions and still be insecure. Security theatre, now available as autocomplete.

7. Copilot Can Serve Old Code With the Confidence of Breaking News

Software changes constantly. WordPress changes. WooCommerce changes. PHP changes. Libraries change. APIs are deprecated. Recommended practices evolve.

A solution that worked several years ago may now be clumsy, unnecessary or simply wrong. Copilot does not automatically know the exact versions, architecture and compatibility requirements of your project unless you provide enough accurate context.

Ask vaguely and you may receive a vague mixture of old and new approaches. GitHub itself advises developers to check for hallucinated APIs, verify that packages actually exist, confirm that dependencies are maintained and make sure generated code follows the current architecture and requirements of the project.

The most dangerous result is not code that immediately crashes. It is code that works just well enough to pass a quick test. No error. No warning. No visible disaster.

Just another quiet piece of technical debt waiting for the next PHP, WordPress or WooCommerce update. The confidence remains beautifully consistent.

8. GitHub Copilot Is Becoming a Shopping Centre for Other Companies’ AI

The name GitHub Copilot suggests one coherent coding assistant. In reality, GitHub Copilot currently provides access to models from OpenAI, Anthropic, Google, Microsoft, xAI and Moonshot AI. Which models are available depends on the plan, application, current release status and GitHub’s policies.

Paid Copilot plans can also use third-party coding agents from Anthropic and OpenAI through GitHub. Those agents consume AI credits and GitHub Actions minutes, with the cost depending on the model used and the number of tokens processed.

So what exactly is Copilot?

Is it the interface?

The subscription?

The code completion?

The chat window?

The agent system?

The model selector?

The billing mechanism?

A Microsoft wrapper around whichever external model happens to perform best this month? The answer appears to be yes.

Microsoft’s marketing wants Copilot to sound like a distinct intelligence with a recognisable identity.

The actual product increasingly resembles an airport terminal where models from different companies arrive, depart and charge different amounts for luggage.

You do not merely use Copilot anymore. You use Copilot to choose a model inside Copilot, possibly to launch another company’s coding agent through Copilot.

Simple. Very Microsoft.

9. The Pricing Needs an Accountant and a Small Sacrifice

GitHub’s current individual Copilot plans include Free, Student, Pro, Pro+ and Max.

The paid individual plans are currently listed at $10 per month for Pro, $39 for Pro+ and $100 for Max.

Remember when software simply had a price?

You paid money. You received software. The transaction was completed without a postgraduate qualification in token economics.

Copilot interactions can consume input tokens, output tokens and cached tokens.

Each model has its own rates, and the cost is converted into GitHub AI credits. One AI credit currently represents one US cent.

When included allowances are exhausted, additional usage may be billed separately. Some annual subscribers remain temporarily under the older request-based system until their existing plans expire.

The basic subscription gives you access to Copilot, except when a particular action uses credits, except when one model costs more credits than another, except when your plan limits that model, except when additional usage is billed separately, except when you remain on an older billing system.

Perhaps the real coding challenge is creating an application that estimates how much your coding application will cost while it helps you create another application.

At least GitHub documents the pricing. It merely looks like the tariff sheet for importing electricity from another galaxy.

10. You Provide the Code the Context and the Responsibility

Since 24 April 2026, GitHub may use interactions from individual Copilot Free, Pro, Pro+ and Max accounts to train and improve AI models unless the user opts out. Those interactions can include prompts, outputs, code snippets and associated context.

GitHub says Copilot Business and Enterprise customer data is not used for model training without authorisation.

The interaction data covered by the policy can include code shown to the model, surrounding code context, comments, documentation, filenames, repository structure, navigation patterns and feedback on suggestions.

GitHub says the data is not shared with independent third-party AI providers for their own training, and individual users can disable the training setting.

Copilot can also produce suggestions matching code in public GitHub repositories.

GitHub provides controls to allow or block such suggestions and can display references to detected matches. However, GitHub notes that suggestions modified by the developer are not checked through the same matching process.

None of this means Copilot automatically steals your entire private repository and sells it from a market stall behind Microsoft headquarters.

It means developers must understand the settings, privacy implications, licensing questions and origins of generated code.

After all that, the responsibility remains yours.

If Copilot generates vulnerable code, it is your plugin. If Copilot misunderstands the requirement, it is your problem. If Copilot deletes data, breaks checkout or allows unauthorised users to change settings, your client will not call Microsoft.

They will call you. Copilot receives the marketing glory. You receive the support ticket.

Copilot Is a Tool Not a Developer

I will continue using AI for development, but not with a loser like Microsoft’s GitHub Copilot sitting beside me. AI remains useful for creating boilerplate, exploring unfamiliar APIs, checking ideas, writing documentation and producing first drafts of repetitive code. Refusing AI completely would be as stupid as trusting it completely.

For balance, GitHub has published its own controlled research reporting that developers using Copilot performed better in a particular Python web-server exercise.

The study reported small improvements in readability, reliability, maintainability and conciseness. Developers using Copilot were also more likely to pass all ten unit tests used in the experiment.

So no, Copilot does not automatically produce bad code. That would be a lazy and dishonest argument. The real problem is the illusion that generating code is the same as developing software. It is not.

Software development includes understanding requirements, making architectural decisions, anticipating unusual situations, protecting data, testing behaviour, maintaining compatibility and returning to the project a year later without asking:

Which fucking idiot wrote this? Sometimes the answer is you.

Sometimes the answer is you with Copilot sitting beside you, enthusiastically suggesting the next line. My old plugins worked. That felt like success.

Now some must be heavily rewritten and others may need rebuilding from scratch. Copilot helped me produce them faster, but speed during construction does not guarantee quality after construction.

You can build a house quickly by firing bricks from a cannon. You will certainly have walls. Whether you want to live inside them is a separate question.

Copilot is not useless. It is simply not magic, not consistent, not independently responsible and definitely not deserving of Microsoft’s desperate attempt to name half the company after it. Use AI. Question it. Test everything it produces. Understand the code before accepting it.

Never assume a clean-looking function is a good function, and never confuse the rapid appearance of code with actual productivity.

Most importantly, do not let Microsoft’s marketing losers convince you that every product, service, chatbot, subscription, keyboard button and electronic toilet brush needs to be called Copilot. One Copilot was a product.

More than eighty Copilots are a stupid approach. It sucks.