AI Tooling, Code Review, and Threat Analysis #47

Today's Letter

1. GitHub, Copilot code review adds org-level controls
2. Microsoft Research, Project Ire flags LOTUSLITE variant

GitHub, Copilot code review adds org-level controls

• GitHub updated Copilot code review with organization-level runner controls, content exclusion support, and removal of custom instruction length limits
• Copilot code review runs on GitHub Actions, and organizations can now set a default runner type across all repositories instead of configuring each repository separately
• Organization admins can lock the runner setting so the organization default overrides repository-level runner configuration
• The runner configuration applies to both Copilot code review and Copilot cloud agent when both features are enabled
• Copilot code review now respects repository, organization, and enterprise Copilot content exclusion settings for specified files and directories
• Repository administrators can define excluded paths with path-based rules to keep irrelevant or restricted content out of review context
• GitHub also removed the previous 4000-character limit for copilot-instructions.md and .github/*.instructions.md files used by code review
• The changes were published in the GitHub Changelog on 2026-06-12 as part of the Copilot code review agentic architecture rollout

Source: github.blog

Microsoft Research, Project Ire flags LOTUSLITE variant

• Microsoft Research said Project Ire identified another LOTUSLITE specimen in a Windows DLL backdoor sample.
• The SHA-256 sample was not included in Acronis TRU's published IOC list for the LOTUSLITE family.
• Ire generated a function-by-function behavioral report, covering install flow, C2 packet layout, command IDs, persistence, and obfuscation.
• Microsoft said the analysis matched Acronis's public LOTUSLITE write-up without origin metadata, telemetry, or analyst prompting.
• VirusTotal showed 1 of 72 vendors detecting the sample on May 28, 2026, rising to 7 of 70 by June 4.
• Major EDR products including CrowdStrike Falcon, SentinelOne, Sophos, Trellix, Palo Alto, and ESET still did not flag it as malware.
• Microsoft positioned Ire as an agentic reverse-engineering system aimed at catching variants that share TTPs but not known IOC hashes.

Source: microsoft.com
More: startuphub.ai

Jocoletter curates AI, software, and product trends for developers and builders.

#GitHub #Microsoft

Subscribe to Jocoletter