Visual Studio 2026: AI Assistant Copilot Fixes NuGet Vulnerabilities

The latest features include creating specialized Copilot agents, defining agent skills, and fixing NuGet vulnerabilities using AI.

(Image: tadamichi / Shutterstock.com)

at 11:21 am CEST

2 min. read

Developer

By

Maika Möbus

Microsoft updated its Visual Studio 2026 development environment in March with new features primarily focused on artificial intelligence (AI). All new functions are available in the Insiders version.

Agent Skills and Custom Agents

In Visual Studio, developers can now create custom Copilot agents. These can, for example, follow the team's coding standards or search internal documentation. The specialized Copilot agents can gain access to workspace awareness, code understanding, tools, the preferred model, and connections via Model Context Protocol (MCP) to external knowledge sources.

To achieve this, developers specify the desired customizations in a .agent.md file, add it to .github/agents/ in the repository, and can then select the new agent in the Agent Picker. If no model is specified, the AI agent uses the model selected in the Model Picker.

Videos by heise

Agents can also be equipped with Skills. The agents automatically retrieve skills from various locations in the repo, such as .github/skills/, or from the user profile, such as ~/.copilot/skills/. Each skill has its own directory with a SKILL.md file that corresponds to the Agent Skill Specification. Agent Skills are an open format for equipping AI agents with specialized knowledge.

Copilot fixes NuGet vulnerabilities

The AI Copilot can now also help fix vulnerabilities. Directly from the Solution Explorer, developers can select the notification “Fix with GitHub Copilot” when a vulnerability affecting NuGet, the package management system for .NET, is detected. By clicking through, Copilot analyzes the vulnerability and can recommend and implement corresponding dependency updates.

The new "Fix with Copilot" option is intended to fix NuGet vulnerabilities.

(Image: Microsoft)

Further updates concern, among other things, the use of MCP: Admins can define which MCP servers are allowed within their organization, and only these can then be used in Visual Studio. Other servers will result in an error message.

The new features can be used in the Insiders build. Microsoft's developer blog provides more information about the updates.