GitHub’s agentic autofix reaches general availability on Enterprise Cloud

GitHub announced general availability of agentic autofix for code-scanning alerts on October 15, 2026. The feature is available to GitHub Code Security and GitHub Advanced Security customers on Enterprise Cloud, including those using its data-residency option. GitHub describes a workflow that prepares a fix, checks it with CodeQL and opens a draft pull request for review.

Enabling it changes both the alert interface and the bill. The free Generate Fix option becomes an Assign to Copilot button, and agentic autofix consumes AI Credits from the Code Security budget as well as GitHub Actions minutes. GitHub says administrators can set SKU-level budgets for Code Security AI credits; credit usage appears under Advanced Security in enterprise billing’s AI usage section.

Access requires two administrative steps. An enterprise administrator must first enable the new Agentic autofix policy in Advanced Security policies. An organization or repository administrator can then switch on the feature in Code Security settings. A Copilot billing method must also be defined.

For an assigned alert, GitHub says Copilot explores relevant files, proposes a patch and reruns CodeQL to check whether the change closes the alert. It can iterate before opening the draft pull request, which includes a summary, an explanation of why the fix closes the alert and the validation steps taken. That is GitHub’s account of the workflow, rather than a measured result from testing supplied with the announcement. Reviewers can request further changes through pull-request comments or the repository’s Agents tab.

The feature is limited to alerts on a repository’s default branch: alerts detected only in pull requests or on other branches cannot be assigned to Copilot. Within that boundary, users can assign an individual alert or select up to 25 alerts from a repository’s security-alert list or a security campaign for Copilot to address in one pull request.