GitHub makes its Copilot-driven code-scanning fixer generally available, with enterprise gating and metered costs

GitHub said on October 15, 2026 that agentic autofix for code scanning alerts is now generally available. According to GitHub's changelog, it is offered to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including the data residency option.

The change is in how a fix is produced. GitHub says that when an alert is assigned to Copilot, the agent explores relevant files, proposes a fix, reruns CodeQL to check that the alert closes, iterates if needed, and then opens a draft pull request. GitHub says the pull request describes the fix, why it closes the alert, and the validation steps taken. Reviewers can ask Copilot for further changes by commenting on the pull request or using the Agents tab. These are GitHub's own descriptions of the design. The changelog gives no figures on how often the validation loop succeeds.

The announcement also sets out the limits on use. Turning the feature on replaces the free Generate Fix option with an Assign to Copilot button. Alerts on a repository's default branch can be assigned individually, in groups of up to 25 that share one pull request, or through the Update a Code Scanning Alert REST API by naming the bot account "copilot-swe-agent[bot]". Alerts found only on pull requests or other branches cannot be assigned.

Access is controlled in layers. An enterprise administrator must first enable a new "Agentic autofix" policy in Advanced Security policies. An organization or repository administrator can then switch it on in Code Security settings, and a Copilot billing method must be defined. The changelog does not say that a separate Copilot subscription is required.

Costs are metered. GitHub says the feature uses AI Credits from the Code Security budget and GitHub Actions minutes. Usage appears under the "Advanced Security" product in the AI usage section of enterprise billing, and administrators can set SKU-level budgets for Code Security AI credits. The changelog does not publish a per-fix price.

What remains uncertain is performance. This article rests on a single primary source, GitHub's own changelog. Other websites that covered the launch appear to restate that announcement and the GitHub documentation. We found no independent testing, customer results or error rates. Teams should treat the generated pull requests as proposals that still need human review.

The launch matters because it moves a security tool from suggesting a patch to carrying out the work of producing and checking one. It also places that work behind enterprise policy and usage-based billing, so adoption will depend on budgets as much as on code quality.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. Correction: the earlier version said agentic autofix is linked to the customer's existing Copilot subscription. The source says only that a Copilot billing method must be defined. The earlier version remains available as revision 1.