GitHub launches general availability of agentic autofix for code‑scanning alerts

GitHub announced that its agentic autofix for code‑scanning alerts is now generally available to customers of GitHub Code Security and GitHub Advanced Security on Enterprise Cloud, including deployments with data residency. The feature is designed to remediate security findings by automatically exploring relevant files, proposing a fix, and re‑running CodeQL to verify that the issue is resolved before opening a pull request for review.

When a developer assigns a code‑scanning alert to Copilot, the agent first scans the repository to locate the affected code, then generates a candidate patch and validates it by executing CodeQL again, iterating as needed until the fix passes. After validation, Copilot creates a draft pull request that contains a summary explaining why the change closes the alert and details the validation steps it performed, allowing a human reviewer to approve or modify the change.

Enabling the feature replaces the previous “Generate Fix” button with an “Assign to Copilot” option on individual alerts, and the same action can be triggered from any alert on the repository’s default branch. Users may also select up to twenty‑five alerts from the security‑alerts list to be fixed together in a single pull request, and the same functionality is accessible programmatically via the Update a Code Scanning Alert REST API by assigning the special bot identifier. Alerts that appear only on pull‑request scans or on non‑default branches are not eligible for assignment to the agent, reinforcing the focus on default‑branch issues.

Access to agentic autofix is gated by an “Agentic autofix” policy that must be turned on by an enterprise administrator in the Advanced Security policies, after which organization or repository administrators can enable the feature in their Code Security settings. A valid Copilot billing method must also be configured before the agent can be used, linking the capability to the customer’s existing Copilot subscription.

The service draws from the organization’s Code Security AI‑credit budget and consumes GitHub Actions minutes, with usage reported in the “AI usage” section of enterprise billing under the Advanced Security product line. Administrators can monitor and cap spending by setting SKU‑level budgets for Code Security AI credits, providing cost‑control while leveraging automated remediation at scale.