GitHub Copilot Is Great at Autocomplete. Whose Code Is It Actually Using?

I’ve had GitHub Copilot running in VS Code for a couple of weeks now, since GitHub opened up the technical preview on June 29. If you haven’t tried it yet, the short version is: you write a function name or a comment describing what you want, and Copilot — powered by an OpenAI Codex model — suggests whole lines or entire function bodies inline, as you type. It’s trained heavily on Python, JavaScript, TypeScript, Ruby, and Go, and when it’s on, it genuinely feels like pair programming with something that’s read every open-source repo on the internet.

Which, it turns out, is close to literally true, and that’s exactly where things get complicated.

Copilot was trained on public GitHub repositories. That includes an enormous amount of code released under permissive licenses like MIT and Apache, but it also includes code under copyleft licenses like the GPL — licenses that come with real obligations about how derivative works get distributed and relicensed. Now that developers are seeing Copilot spit out completions that look like they could be lifted near-verbatim from a training example, the obvious question is: if a model was trained on GPL code and then reproduces something close to it in my proprietary codebase, whose license governs that output? Mine? The original repo’s? Nobody’s, because a suggestion from a statistical model isn’t a “copy” in the legal sense at all?

GitHub hasn’t offered a clean answer to that yet, and I don’t think there is an easy one sitting on the shelf. Copyright law wasn’t written with this scenario in mind, and the existing frameworks for open-source licensing assume a human is doing the copying, forking, or relicensing — not a neural network trained on millions of repositories doing something that’s arguably closer to statistical pattern extraction than copy-paste. Whether that distinction holds up legally is a genuinely open question, and it’s one that’s going to matter a lot more once tools like this move from “cool preview” to “default part of how people write software.”

Why this matters beyond the legal nerdery

Setting the licensing question aside for a second, Copilot is a preview of something bigger: code-generation models trained on huge public corpora are going to keep getting better, and they’re going to keep raising this same tension. The value of these tools is directly proportional to how much code they were trained on — the more data, the better the suggestions. But that same scale is what makes provenance impossible to fully audit after the fact. You can’t easily ask the model “which repo did this fifteen-line function come from” any more than you can ask a human developer to cite every piece of code they’ve ever read that influenced how they write loops.

For now, Copilot is still a technical preview, and GitHub has room to figure out attribution, licensing safeguards, or opt-outs before this becomes a full product. I’d rather they take the time to get it right than ship something that quietly puts every developer using it into legal gray area. But given how good the suggestions already are, I suspect the pressure to ship fast is going to be intense.