The interesting question about AI coding tools stopped being 'does it work' about two years ago. It is now 'where does it cost you more than it saves'. After a year of Copilot in VS Code across three real codebases, I have a clear map of both.
What it is genuinely great at
Tests. Boilerplate. Data transformations. Regular expressions. Configuration files in a syntax I use twice a year. In these cases the suggestion is usually correct on the first try and reviewing it takes seconds.
It is also a superb autocomplete for patterns already present in the file. Once you have written one mapper function, the next four write themselves accurately.
Where it costs you time
In an unfamiliar framework, Copilot produces code that looks idiomatic and is subtly wrong — a deprecated API, a hook called in the wrong place, an option that never existed. It is confident, so it is persuasive, so you lose twenty minutes.
- Highest value: tests, boilerplate, migrations, docstrings
- Neutral: business logic you already understand
- Negative value: unfamiliar libraries, security-sensitive code, anything you cannot verify quickly
Chat and agent mode
Chat is a good explainer, particularly for inherited code — highlight a function, ask what it does, get a usable answer. Agent mode, which makes multi-step edits across files and can open a pull request, is impressive in demos and inconsistent in large repositories. Cursor still handles whole-codebase context better.
The security habit you need
The real risk is not that Copilot writes bad code; it is that accepting a suggestion feels like less of a decision than writing one. Set a rule and keep it: nothing gets committed that you could not explain in review. That single discipline turns Copilot from a liability into leverage.
Verdict
A year in, I would not code without it, and I trust it least exactly where I know least. Ten dollars, high return, one discipline required.