On 25 September 2026 Microsoft relaunched Copilot around three modes — Home, Code and Autopilot. The one that matters here is Code: describe what you need in plain English and Copilot builds it, from a desktop widget to an interactive dashboard to a cloud-hosted internal app, running in a sandbox inside your own Microsoft 365 tenant and powered by the same engine as GitHub Copilot. CNBC read the launch plainly — Microsoft is chasing Anthropic. For a business owner the more useful question is not which model is smartest. It is: when the app appears, how far is it from something you can actually run?
That is a question we can answer with data rather than opinion, because we spend a lot of our time on the other end of this pipe — taking software that was generated from a prompt and making it survive contact with real users. This piece compares Copilot Code with the two tools professional engineers reach for, Claude Code and Cursor, then scores all three with an original gauge we use internally, the Production Distance Index.
01The 30-second version
What Microsoft actually shipped
The new Copilot is one app doing three different jobs, and it helps to keep them separate:
- Home— Chat and “Cowork” in one place, with Word, Excel and PowerPoint built in. Chat handles quick asks; Cowork delegates a whole task. This is an assistant, not a builder.
- Code— the headline. A non-developer describes a need and Copilot returns a working app: a persistent desktop widget, a dashboard for exploring data, or a cloud-hosted internal tool. It runs sandboxed within your tenant and grounds itself in your data through Microsoft IQ. Rolling out through the Frontier program from the end of September, broad availability “in the coming weeks”.
- Autopilot— a persistent agent with its own identity, memory, computer and workspace that keeps working unprompted. Private preview from the end of the month. The most interesting, and the one we’d treat with the most caution (more below).
Not because the technology is new — Cursor, Claude Code, v0, Lovable and Bolt have done prompt-to-app for over a year. It is a big deal because Microsoft is putting it in front of hundreds of millions of office workers who have never opened a code editor, next to their existing files and permissions. That widens the top of the funnel enormously. It also widens the bottom of ours: more apps built by people who cannot see what is missing.
02Like for like
The three sentence-to-software builders
All three turn intent into code. They are built for different people, and that difference — not the underlying model — decides where each one belongs.
Microsoft Copilot Code
Business userInternal apps, dashboards and desktop widgets, built from a description and grounded in your Microsoft 365 data.
A spreadsheet held together with macros, a shadow-IT Access database, or a ticket to an overloaded internal-tools team.
The killer feature is not the code generation — it is the context. Because it runs in your tenant, it already knows your files, lists and permissions, so “a dashboard of open supplier invoices” can actually resolve to your data. For a genuinely internal tool used by a handful of colleagues, that is a real productivity unlock.
The gap is everything a business user cannot be expected to specify: who is allowed to see each row, what happens when an input is malformed, where the audit trail lives, and how you roll back a bad change. Sandboxed-in-tenant limits the blast radius; it does not write your access rules for you.
Claude Code
Engineer, terminalChanges to a real repository — multi-file edits, tests, refactors — driven from the terminal by an engineer who reviews every diff.
Hours of an engineer's own typing, not the engineer.
Claude Code assumes a codebase, a test suite and a human who reads pull requests. Its output lands where the guardrails already are: version control, CI, review. That is precisely why it is safe to move fast with — the safety net is the repository, not the model.
It is the wrong tool for a non-developer. There is no “it just works” surface; there is a working tree, and you are expected to know what a working tree is.
Cursor
Engineer, IDEAn AI-native editor where an engineer builds and steers with the whole codebase in context, inline and interactively.
Context-switching between an editor and a chat window.
Cursor sits between the two: more visual and interactive than a terminal agent, but still an IDE for people who write software. Like Claude Code, its output inherits whatever discipline the surrounding project has — tests, types, review — so its production distance is a property of the team, not the tool.
Put the same three tools in front of a professional engineer and the difference between them is ergonomics and taste. Put them in front of a non-engineer and only one of the three is even designed for that — which is exactly why Copilot Code will generate the most software, and the most software that needs a second pair of eyes.
03Our scoring model
The Production Distance Index
We needed a way to talk to clients about AI-built software without arguing about which model is “better”, so we score output on Production Distance: how many of five non-negotiable gates a tool clears on its own, before an engineer touches it. Each gate is one point of distance still to close.
- Access & data isolation — is every row and route actually authorised, not just hidden by the UI?
- Input & error handling — does it fail safely on bad or hostile input instead of 500-ing or corrupting data?
- Secret handling — are keys and tokens scoped and stored properly, not baked into the client?
- Tests & observability — is there any automated test, log or alert, so a regression is visible before a customer finds it?
- Deploy & rollback — is there a reviewed, reversible path to production, or is “live” wherever it was generated?
The scores below are not vendor benchmarks. They are what we consistently see in the artefacts these tools produce, calibrated against our own audit work: a code-level teardown of 31 AI-generated Lovable / Bolt / v0 / Cursor codebases, and a separate review of 25 AI-generated Supabase databases where only 5 had correct row-level security.
The failure modes cluster, and they are the same regardless of which tool generated the code. Four out of five AI-generated databases we reviewed shipped with broken or absent row-level security — the app looked right because the UI hid the wrong rows, while the API served them to anyone who asked. Missing tests and unhandled errors were near-universal. None of that is a knock on the models; it is what happens when the person driving cannot see the gate they are walking past. A tool aimed at non-developers removes the last person in the loop who could.
So the Index does not reward the smartest model — it rewards the tool least likely to let its driver ship a hidden gap. Copilot Code and the vibe-coding tools carry the most residual distance not because they generate worse code, but because their users are the least equipped to close the remaining gates. Claude Code and Cursor carry less in the hands of an engineer, because the engineer and the repository close the gates the model leaves open. Hand either of them to a non-developer and the distance climbs straight back up. The tool sets the floor; the operator sets the score.
04Decide
Which one to reach for
The honest rule is about stakes, not smarts. Sort by what the software touches:
Fine for Copilot Code
- An internal dashboard a handful of colleagues read.
- A personal or team widget that only reads data, never writes.
- A throwaway prototype to show an idea, that you expect to rebuild.
- Anything where the worst case is “it’s wrong and we notice”.
Belongs with engineers (Claude Code / Cursor + review)
- Anything a customer or the public can reach.
- Anything holding personal, financial or regulated data.
- Anything that writes to a shared system of record.
- Anything a real business decision or payment depends on.
Autopilot deserves its own line. A standing agent with its own credentials, memory and network access is, from a security point of view, a new member of staff who never sleeps and never forgets a token. Treat it that way: least-privilege scopes, a real audit trail, and a kill switch. We wrote the practical version of that discipline for a different agent — giving an AI agent safe write access without handing over a staff login — and the same principles apply to Autopilot on day one.
We are not anti-Copilot — we are the team you call once the prototype has to become a product. We take software built in Copilot Code, Cursor, Lovable or Bolt and close the production distance: access control, tests, secrets, observability and a reversible deploy. If a business-built tool has quietly become load-bearing, that is our software rescue & security work; if you are building the real thing from the start, that is product engineering. We also design the AI features themselves — see AI systems. Start from the contact page.
One economic note, because it decides more than people expect: a prompt-built app is cheap to create and expensive to operate if nobody costed the model calls or the hosting. We broke that down in the per-token economics of an AI feature and in what it really costs to take a Lovable app to production. Copilot Code changes who builds the first version; it does not change the arithmetic of running it.
05Questions
Frequently asked questions
What is Microsoft Copilot Code?
Code is one of three modes in the new Copilot Microsoft launched on 25 September 2026 (alongside Home and Autopilot). It lets a non-developer describe an app in plain English and have Copilot build it — persistent desktop widgets, interactive dashboards, or cloud-hosted internal apps — running in a sandbox inside your Microsoft 365 tenant. Microsoft says it is powered by the same technology as GitHub Copilot.
Is Copilot Code better than Claude Code or Cursor?
They are not the same tool. Copilot Code is aimed at business users building internal apps inside Microsoft 365 with tenant data already connected. Claude Code and Cursor are aimed at professional engineers working in a real repository with tests, review and deploys. For a throwaway internal dashboard, Copilot Code is faster; for anything customers touch or that holds real data, an engineer-driven tool with a proper pipeline wins.
Can you ship a Copilot Code app straight to production?
You can ship an internal, low-stakes app to a small team. You should not put customer-facing or data-sensitive software live from any prompt-to-app tool without an engineering pass. In our audit of 31 AI-generated codebases, the recurring failures were missing access control, unhandled errors and absent tests — exactly the gates a natural-language builder does not enforce for you.
What is Copilot Autopilot?
Autopilot is the third mode: a persistent agent with its own identity, memory, computer and workspace that keeps working when you are not prompting it — watching channels, following up on threads and running recurring tasks. It is the most novel and the highest-risk of the three, because a standing agent with credentials and network access is a standing attack surface that needs the same scoping and audit trail you would give a member of staff.
Primary sources
- Microsoft — Introducing the new Copilot with Home, Code and Autopilot
- CNBC — Microsoft touts Copilot app with coding, Autopilot to chase Anthropic
Not affiliated with or endorsed by Microsoft, Anthropic or Cursor. Product names are used for identification only.
