Table of Contents
- Introduction
- What Happened: An AI-Powered Port
- The Numbers: Cost, Speed, and Scale
- Performance Gains: 15.9x Faster, 10x Less Memory
- Where the Copilot Runtime Lives
- How the Agents Worked: Investigation, Not Code Spewing
- The Regression Problem: The Compiler Isn't an Oracle
- Why This Matters for Every Business
- Why Businesses Rely on Managed IT Services for AI-Assisted Development
- What Businesses Should Do
- Final Thoughts
Introduction
The software engine underpinning GitHub Copilot and a growing number of Microsoft products is now written entirely in Rust — with AI agents doing most of the porting work.
The migration cost about $120,000 in AI token usage plus about three weeks of a developer's time. However, managers also had to grapple with a few dozen regressions in the resulting code, pointing to AI's ongoing challenges in understanding Rust.
This blog is based on reporting by Joab Jackson (September 18, 2026).
What Happened: An AI-Powered Port
The effort updated the runtime module-by-module until the job was completed, spanning:
- Over 135 releases
- 14.5 weeks of elapsed time
- Roughly 1.3 port pull requests per day
Overall, agents converted 430,000 lines of TypeScript into 800,000 lines of production Rust. To keep the port as simple as possible, the port only replaced TypeScript modules on a case-by-case basis. It didn't look to optimize the structure of the runtime itself — that work is next.
The project used Copilot to rewrite Copilot, which in turn used several LLMs — GPT-5.6 Sol and Claude Opus 4.8 were both namechecked — to execute different parts of the job based on each model's strengths.
The Numbers: Cost, Speed, and Scale
Microsoft Distinguished Engineer Stephen Toub explained the entire process in a detailed post. Here's how the project broke down:
| Metric | Value |
|---|---|
| AI token cost | $120,000 |
| Developer time | ~3 weeks |
| Total duration | 14.5 weeks |
| Releases | 135+ |
| Port PRs per day | ~1.3 |
| TypeScript converted | 430,000 lines |
| Production Rust produced | 800,000 lines |
| LLMs used | GPT-5.6 Sol, Claude Opus 4.8 |
"This is in no way a claim that every large TypeScript program should become Rust. Our requirements emphasized embedding through a C ABI, low startup and steady-state overhead, and predictable resource use. Rust made those goals possible."
— Stephen Toub, Microsoft Distinguished EngineerPerformance Gains: 15.9x Faster, 10x Less Memory
Rust, known for its lean performance, did not disappoint. The benchmark results were dramatic:
TypeScript (Original)
- 7.55 session lifecycles per second
- 1,383 MB for 10-client batch
- Spawned external background processes
- Node.js + V8 execution engine
Rust (New)
- 120 session lifecycles per second
- 126 MB for 10-client batch
- In-process execution (no external processes)
- Native Rust runtime
That's a 15.9x speedup on the benchmark workload and roughly 10x less memory for the same agent swarm.
The performance improvements are real and significant — this isn't marketing. The benchmark measured 1,000 one-turn session lifecycles with a shared client and 100 concurrent pipelines.
Where the Copilot Runtime Lives
At first glance, most users may not know how pervasive the Copilot runtime is. It backs:
- GitHub Copilot CLI
- The Copilot app
- The SDK
- The GitHub Copilot cloud agent
- VS Code and Visual Studio
- Excel, Outlook, PowerPoint
- Innumerable other Microsoft cloud services
Originally, the runtime was written in TypeScript and used Node.js as the framework and V8 for the execution engine. TypeScript and Node were great for rapid development, but at scale they suffered in fast start-up and server density.
How the Agents Worked: Investigation, Not Code Spewing
Toub assessed the use of agents as largely successful — this project would have taken years and cost millions if done by hand.
Agents showed several surprising emergent behaviors. For one, they spent far more time gathering information than actually writing code.
"The popular image of AI spewing code is almost backwards; at this scale, the work looked much more like iterative investigation, inspecting the current state, forming a hypothesis, making a targeted change, rinsing and repeating."
— Stephen ToubAnother surprise was how frequently sessions interacted with other sessions — either those they spawned or other ones entirely.
The session.ts Case Study
One of the thorniest conversions was the session.ts file — over 30,000 lines of TypeScript that touched all aspects of the runtime. The porting session:
The agent spent nearly an hour reading documentation before making any changes.
The agent asked for help repeatedly, gathering context before acting.
Each child session created its own worktree and agent.
Using a built-in orchestration skill, one session found every other active session and sent messages to those whose missions overlapped.
One file took 25 hours of agent time.
The Regression Problem: The Compiler Isn't an Oracle
But there are hidden dangers in using Rust as well, as Toub found. For an LLM and a lazy programmer alike, if the code compiles, then it is valid Rust.
Throughout the process, the project encountered dozens of regressions — code that used to work but no longer does after an update.
The compiler has no idea whether functions are in the right order, whether the job completes at an acceptable cost, whether it meets the developer's unwritten requirements, or whether it is internally coherent at all.
"Rust stops the agent writing memory unsafe code; it does not stop the agent writing the wrong program correctly."
— Lisa Crossman, consultant, at RustConfToub found that compiler-approved regressions could come from:
- Ambiguous semantics and behaviors
- Branch drift — where code paths diverge from the original intent
- Missing features that weren't ported over
- Differing behaviors from the replacement code
"That's in no way an argument against Rust's compiler. But 'if it compiles, it's correct' is useful only as a joke."
— Stephen ToubWhy This Matters for Every Business
At first glance, this is a story about Microsoft's internal engineering. But it points to a major shift in how software gets built — one that will affect every business that relies on custom software:
- AI-assisted development is now production-grade — Microsoft shipped real, high-performance code written by AI agents
- Costs are dramatically lower — $120K for a project that would have taken years and millions to do by hand
- Regressions are real — Even Microsoft had to fix dozens of issues that the compiler didn't catch
- Human review is still essential — The compiler validated syntax but not correctness or intent
- Multi-agent orchestration works — Agents spawned children, communicated, and coordinated to complete complex tasks
- Development velocity is changing — What took years now takes weeks; what took months now takes days
If Microsoft needed human oversight to catch dozens of regressions in an AI-generated port, your business needs a plan for AI-assisted development too — including code review, testing, and deployment controls.
Why Businesses Rely on Managed IT Services for AI-Assisted Development
Here's the reality: AI-assisted development is arriving faster than most businesses can build governance for it. Tools like GitHub Copilot, Claude, and Copilot Studio are already being used by developers inside most organizations — whether IT knows it or not.
That's where Managed IT Services (MSPs) come in. A modern MSP provides the guardrails, tooling, and oversight that make AI-assisted development safe, efficient, and compliant.
What a Managed IT Services Partner Does for AI-Assisted Development
When AI starts writing your production code, your MSP partner should be managing the risk layer. Here's what that looks like:
- AI development tool governance — Tracking which AI coding tools are in use and how they're being used
- Code review and testing discipline — Ensuring AI-generated code goes through the same review process as human-written code
- CI/CD pipeline security — Verifying that AI-generated code doesn't skip security gates or introduce known vulnerabilities
- Dependency and supply chain monitoring — Catching vulnerable libraries introduced by AI tools
- Secret scanning — Making sure AI tools don't leak API keys or credentials into code
- Intellectual property protection — Ensuring AI coding tools aren't introducing licensed or proprietary code
- Cost management — Tracking AI token usage and optimizing model selection for cost/performance
- Agent orchestration oversight — Monitoring AI agents that spawn other agents, as Microsoft's case study showed
- Compliance alignment — Mapping AI-assisted development to SOC 2, ISO 27001, and other frameworks
Why SMBs Choose Managed IT Over DIY
For most organizations, the "let developers use whatever AI tools they want" approach creates real problems:
- No visibility — You can't govern what you can't see, and shadow AI use is rampant
- Compliance exposure — AI tools that leak code to public services can violate IP agreements and regulatory requirements
- Security gaps — AI-generated code can introduce vulnerabilities that slip through review
- Cost overruns — Unmonitored AI token usage adds up fast
- Quality drift — As Microsoft's own case showed, AI code compiles but may regress functionally
- Skill gap — AI development governance is a specialized, emerging discipline
If your organization is using GitHub Copilot, Claude, ChatGPT, or other AI coding tools — and you don't have governance in place — a Managed IT Services partner can help you enable AI development safely.
What to Ask a Potential MSP Partner About AI Development
If you're evaluating MSPs (or wondering whether your current one is ready for this), ask these questions:
- Do you have visibility into which AI coding tools our developers are using?
- Do you scan AI-generated code for secrets, vulnerabilities, and dependency risks?
- How do you enforce code review and testing for AI-assisted changes?
- Do you track AI token costs and help us optimize model selection?
- Can you help us build an AI development policy?
- How do you handle compliance for AI-assisted development?
At SystemLogicIT, we provide Managed IT Services and Cyber Threat Protection tailored to businesses across the United States and United Kingdom. If your organization is adopting AI-assisted development and wants a partner who can govern it safely, we'd be glad to talk.
What Businesses Should Do
Whether you manage IT in-house or through a partner, here's a practical checklist based on Microsoft's experience:
- Inventory AI coding tools — Know which tools your developers are using (GitHub Copilot, Claude, ChatGPT, etc.)
- Establish an AI development policy — Document which tools are allowed and how they can be used
- Require human code review — AI-generated code should go through the same review process as human code
- Run automated security scans — Check AI-generated code for secrets, vulnerabilities, and license issues
- Test for regressions — Don't trust the compiler to catch functional errors; test behavior
- Monitor token costs — Track AI usage and optimize models for cost/performance
- Watch for shadow AI use — Developers may be using AI tools without telling IT
- Review dependencies — AI tools may pull in libraries you didn't approve
- Track agent orchestration — If you use multi-agent workflows, log their activity
- Engage a Managed IT Services partner — If AI development governance isn't feasible in-house
If your organization needs help governing AI-assisted development, building security controls, or managing costs, consider working with a Managed IT Services partner.
Final Thoughts
Microsoft's Copilot runtime port to Rust is a milestone — not because AI wrote code (we've seen that before), but because AI wrote 800,000 lines of production Rust that now powers Copilot across Microsoft's product lineup.
The performance gains are real: 15.9x faster, 10x less memory. The cost was a fraction of what manual porting would have required. The multi-agent orchestration was sophisticated — agents spawned children, coordinated with each other, and worked through problems iteratively.
But the regressions are the real lesson. Even Microsoft, with world-class engineers and sophisticated review processes, had to fix dozens of functional regressions that the compiler happily accepted. As Lisa Crossman said, "Rust stops the agent writing memory unsafe code; it does not stop the agent writing the wrong program correctly."
For every business, the implication is the same: AI-assisted development is here, and it needs governance.
Key takeaways:
- Copilot runtime is now Rust — 430K TypeScript lines → 800K production Rust lines
- Cost was $120K in AI tokens + 3 weeks of developer time
- Performance gains are dramatic — 15.9x speedup and 10x less memory
- Multi-agent orchestration works — Agents spawned children and coordinated
- Agents investigate more than they code — The popular image of "AI spewing code" is backwards
- Dozens of regressions caught — Even compiler-validated code can be functionally wrong
- Compiler ≠ oracle — "If it compiles, it's correct" is a joke
- This will happen in every business — AI-assisted development is arriving fast
- Managed IT Services bridge the gap — AI development governance, security, cost tracking
- Human oversight is essential — Microsoft proved it, and so will you
If your organization needs help governing AI-assisted development, building security controls around AI coding tools, or managing costs, contact SystemLogicIT for expert Managed IT Services and Cyber Threat Protection across the United States and United Kingdom.