Summary
Copilot SDK v1.0.13-preview.1 makes ClientMode.Empty apply deny-by-default isolation to built-in skills across all six SDKs. Hosts can re-enable selected skills through includedBuiltinSkills, while sessions created in Empty mode otherwise start without runtime-bundled skills.
Why it matters
This gives developers embedding Copilot agents a narrower capability baseline and an explicit allowlist for skills that can execute inside an application.
Related coverage
- AI-Infra-Guard 4.6 adds LLM API-poisoning checks and agent red-team coverage
- Codex CLI 0.150 makes cross-task coordination and trust controls first-class
- Anthropic updates Claude Code and its TypeScript Agent SDK