Six changes, two directions, one four-month window
Between April and July 2026, gh shipped four new command groups and two security-driven point releases. Read as separate changelog entries, each looks routine: a new command here, a patched CVE there. Read together, against real dates, they point the same direction twice.
gh skill (2026-04-16) and gh agent-task (still preview) give gh a terminal surface for AI-agent tooling: installing skills across more than 30 agents, and driving GitHub’s own asynchronous Copilot coding-agent runs. gh discussion and the sub-issue and dependency flags on gh issue, both shipped in the same v2.94.0 release on 2026-06-10, give gh a terminal surface for repo hierarchy that used to live only in the web UI or a handwritten GraphQL call. Underneath both threads, v2.96.0 and v2.97.0 closed a real remote-code-execution path and a real terminal-injection bug, hardening the same command surface that now touches more content it didn’t write itself: agent output, someone else’s PR diff, someone else’s gist.
That’s the actual synthesis, not a single command worth learning. gh spent four months becoming a control surface for two things GitHub used to gate behind a browser: an AI agent’s own tooling, and a repository’s own issue tree.
Structural Comparison Matrix
| Capability | Before this wave (pre-April 2026 gh) | After this wave (through v2.97.0) |
|---|---|---|
| Cross-agent skill install/update | Clone or download a repo, copy files into each agent’s own directory by hand, no update path | gh skill install/update/publish --agent <name>, one flag across 30+ agents |
| GitHub Discussions from the terminal | Raw gh api graphql against the Discussions schema, cursor pagination by hand | gh discussion list/view/create/edit/comment |
| Issue hierarchy and dependencies | GitHub.com sidebar only, or a handwritten GraphQL mutation | gh issue edit --parent, --add-sub-issue, --add-blocked-by |
| Driving Copilot’s async coding agent | No terminal path; GitHub.com only | gh agent-task create/view/list (still preview) |
| Terminal safety against untrusted content | Escape sequences in a gist, diff, or agent-task output printed raw | Sanitized by default since v2.97.0, opt out only with --allow-escape-sequences |
Every row above is sourced from the cluster post that actually researched it, linked below, not re-derived here.
Thread one: gh becomes agent tooling
gh skill gave gh its first real lifecycle for AI-agent skills: install, preview, search, update, and publish, all behind one --agent flag that recognizes more than 30 coding agents by name. gh skill: Manage AI Agent Skills From GitHub CLI covers the full command set and the tag-versus-commit-SHA pinning distinction that matters for reproducible CI installs.
gh agent-task extends the same thread further. Its own manual page states plainly what it operates on:
“a task is a GitHub issue that triggers automated code changes from natural language instructions”
That makes it a terminal driver for GitHub’s own Copilot coding agent, still labeled preview, and one of the newest command groups this wave shipped. No dedicated cluster post exists for it yet in this series, so this synthesis leans on that manual definition and the hub’s own description rather than research this article didn’t do. It’s worth distinguishing from a separate GitHub product covering similar ground from a different angle: see the FAQ below on how it differs from GitHub Agentic Workflows in Actions.
Thread two: gh becomes a repo-hierarchy client
gh discussion and the sub-issue and dependency flags on gh issue landed in the same v2.94.0 release, 2026-06-10, closing two unrelated gaps at once. Neither depends on the other; they shipped together because both moved a GitHub.com-only feature into a scriptable terminal command.
gh discussion: GitHub Discussions in Your Terminal covers list, view, create, edit, and comment, plus what the command group still can’t do (closing, locking, or deleting a discussion still needs raw gh api graphql). Manage GitHub Sub-Issues and Dependencies via gh CLI covers --parent, --add-sub-issue, and --add-blocked-by, and one real correction worth repeating here rather than re-deriving: GitHub’s own changelog for that release names a --set-parent flag that does not exist in the shipped CLI. Only --parent and --remove-parent are registered; --parent handles both the first link and any later change.
The security cost of touching more untrusted content
A command surface that reads more content it didn’t write, gist files, PR diffs, agent-task output, is also a command surface with more to sanitize before printing it to your screen. Both of this wave’s security releases fall out of that same expansion.
v2.96.0 (2026-07-02) closed a real remote-code-execution path in gh codespace jupyter: a crafted vscode:// URL from inside a malicious or compromised Codespace could hand off command execution to the victim’s own machine, tracked as GHSA-8cg3-r6g9-fpg2. Full detail in Update gh CLI Now: Codespace Jupyter RCE Fixed.
Update before adopting anything else in this post
Neither security release above is optional reading. If gh --version reports
anything older than 2.97.0, run your package manager’s update command before
wiring any new command group from this post into a script or a habit.
v2.97.0 (2026-07-31) is worth one correction here, because a single changelog line invites a conflation that isn’t accurate. GitHub’s own release notes for that version list four separate security advisories fixed the same day, not four terminal-injection bugs. Only one of them, GHSA-3m3g-3wcr-px46, is the terminal-injection issue, and it touches seven separate command paths, not four, gh api and gh pr diff among them, both gh agent-task subcommands included. The other three advisories fixed that same day cover an unrelated URL-path-escaping bug, a partial auth-token leak in gh auth status, and a regex-escaping bypass in gh attestation verify, three different bug classes in three different commands. See gh CLI 2.97.0 Fixes Terminal Injection in 7 Commands for the full seven-command list and the fix itself.
Two of the seven sanitized commands, gh agent-task view and gh agent-task create, belong to the same agent-tooling thread this post opened with. That’s not a coincidence worth glossing over: the newest, least-tested command surface is also the one that needed a security patch in its first few months.
What’s still preview, and what already shipped stable
Not every command in this wave carries the same production confidence. GitHub’s own gh manual states the same caveat for two of the four, word for word except for the one swapped noun:
“Working with agent skills in the GitHub CLI is in preview and subject to change without notice.”
Swap “agent skills” for “discussions” and that’s the exact sentence covering gh discussion too. gh agent-task carries its own preview label directly on its manual page, a shorter but equally direct signal.
Issue hierarchy is the exception. The --parent, --add-sub-issue, and --add-blocked-by flags shipped in v2.94.0 without a preview caveat attached anywhere in GitHub’s changelog or gh’s own docs. If you’re choosing where to script first, that’s a real, sourced reason to start with the hierarchy flags over the other three.
This is the tenth and closing post in a 10-part series; it earns its place the same way Same Prompt, Different Bill closes this site’s LLM pricing series, tying several individually-dated changes into one decision instead of adding an eleventh isolated fact. See GitHub CLI’s 2026 Agent-Era Expansion for the hub linking all ten pieces.
Update first, then adopt selectively
Check your version before anything else:
gh --versionAnything before v2.97.0 is missing a real security fix, not a feature. Update through whatever channel installed gh: brew upgrade gh, apt update && apt install gh, scoop update gh, or a fresh binary from cli.github.com. Past that baseline, adopt selectively rather than all at once. gh skill and gh agent-task earn their place the moment you’re managing AI-agent tooling across more than one machine or one agent. gh discussion and the sub-issue flags earn theirs the moment a script needs to read or change something that used to require a browser tab. None of the four demand adoption on day one, but the pattern behind them does demand attention: gh isn’t just tracking GitHub’s web features anymore, it’s becoming the terminal’s own control point for them, and a version bump in this series is worth reading before you skip it.
Browse more coverage like this in the Dev Tools archive.
