On May 17, the model writing code across every Copilot Business and Enterprise organization changed, and almost none of the developers on those plans did anything. GitHub switched the base model for all of them to GPT-5.3-Codex, replacing GPT-4.1; individual Pro, Pro+, and Free seats were left alone, still free to pick for themselves. If you are on a Business or Enterprise plan, the default model you get when you open Copilot is now a decision your platform made, not one you made.
”Base model” is a quiet phrase
The word doing the work is “base.” A base model is what you get if you do not pick something else — and most people do not pick something else. The entire history of software defaults says so: defaults win, overwhelmingly, because changing them costs attention and the default is right often enough that spending that attention rarely feels worth it. People open the editor and use what is there. So when the base changes, the model that writes the median line of enterprise code changes, silently, for everyone who never opens the model picker — which is most of the seats. GitHub also made Gemini 3.5 Flash generally available in Copilot the same week, which sounds like more choice, and is — for the minority who go looking. For everyone else, choice you do not exercise is choice you do not have, and a model picker nobody opens is a setting, not an option.
I went through a version of this with the Opus 4.7 stack reshuffle: a new model lands, becomes the default, and the tools quietly reroute everyone onto it. What is different here is the explicit framing. GitHub is not just changing a default; it is designating GPT-5.3-Codex a long-term-support model, with a 12-month availability guarantee through February 2027.
LTS cuts both ways
I want to be fair to the LTS idea, because there is a real need under it. Enterprises run security and safety reviews against the model they deploy. If the model changes every few weeks, those reviews are obsolete on arrival. A guaranteed-stable model you can certify once and trust for a year is genuinely valuable, and “long-term support” is the right concept borrowed from the right place.
But LTS is also lock-in wearing a responsible outfit. A model guaranteed to stay is a model you are guaranteed to keep using, and the same stability that lets the security team certify it is the stability that makes it hard to move off when something better ships. A year is a long time in this field; the model you are certified onto in May could be two generations behind by the following spring, and the LTS guarantee that protected your security review is now the thing keeping your developers on the older model. The 1× premium-request multiplier on GPT-5.3-Codex — versus the 0× that GPT-4.1 carried until it deprecates with usage-based billing on June 1 — means the stable choice is also the metered one. Stability, lock-in, and a billing event arrive in the same package, and only one of them is printed on the label.
The part that should bother you
Here is what I keep turning over. Three things a developer used to control moved further out of reach this week. The per-call price went up while wearing the “Flash” label that says it went down — the Flash that got expensive. The agent runs unattended on a schedule now, so you are not there when it works — the agent that runs while you sleep. And the model itself is a platform default you did not set and may not be able to change. Cost, timing, and identity — the three knobs that used to be yours — are increasingly somebody else’s settings.
None of this is a conspiracy; it is the natural direction of a maturing platform. Defaults consolidate. Stability gets productized. The vendor makes the choice most users would have made anyway and saves them the trouble. The cost is that “most users” is an average, and you are not the average on the day the default is wrong for your codebase and you find you cannot easily override it.
What to actually track
So the question I would put to any team on Copilot Business or Enterprise is concrete. Do you know which model wrote what? Can you pin a model per repository, or are you on the base whether you like it or not? Was the base-model decision visible to the engineers living with it, or did it change on May 17 and nobody told them? Model provenance — which model produced which code — is about to matter the way dependency provenance started mattering a few years ago. The reason is the same one that drove software bills of materials: when a component turns out to have a flaw, the first question is “where did we use it.” If a model ships with a regression — a subtle bias toward an insecure pattern, a habit of hallucinating a particular API — the teams that tracked which model wrote which code can answer “where did we use it” in an afternoon, and the teams that did not get to read every diff from the last six months. The teams that can answer “which model wrote this” will be the ones who chose to track it before the platform decided they did not need to. The how-to for staying in the driver’s seat is choosing and pinning Copilot models; the release that triggered all this is GitHub Copilot makes GPT-5.3-Codex its enterprise base model; the economics that frame it are in the Copilot pricing shock.
