GitHub makes agentic autofix generally available for code scanning alerts

From a suggested edit to a draft pull request

The agent explores repository files, proposes a fix and reruns CodeQL, GitHub's code analysis engine for automated security checks, to check whether the change closes the alert before opening a pull request for review. GitHub's announcement and TechEnclave's coverage describe that workflow and the ability to combine up to 25 alerts in one pull request.

The change is not simply a new label for the previous fix generator. According to GitHub, enabling agentic autofix replaces the free Generate Fix action on individual alerts with Assign to Copilot. Its documentation distinguishes that agent workflow from non-agentic Copilot Autofix, which generates a single suggested change without consuming AI credits.

For security teams processing an alert backlog, the new workflow combines patch preparation and validation work, but it also changes the billing exposure of the alert-level action. GitHub's billing documentation values one AI credit at $0.01; that is a billing unit, not a quoted price for fixing an alert.

Validation does not remove the review step

GitHub describes fix validation as best-effort. Its documentation says Copilot cannot confirm fixes for alerts from custom CodeQL queries, the security-extended suite or third-party tools. The promise of a CodeQL rerun therefore has a narrower scope than a guarantee that every proposed change resolves its security finding.

GitHub says the resulting draft pull request includes a summary and validation steps, and that changes require review and testing before merging. Grouping alerts changes the unit of review—from an individual suggested edit to a potentially multi-alert pull request—but does not establish that reviewers will spend less time on it.

According to the changelog, only default-branch alerts are eligible. Findings confined to pull requests or other branches cannot be assigned to Copilot. The feature therefore addresses eligible findings already on the default branch rather than every finding encountered during development.

Enterprise controls come before repository access

Availability includes Enterprise Cloud with data residency. An enterprise administrator must first enable the new Agentic autofix policy; GitHub says organization and repository administrators can then enable the feature in Code Security settings. The company also requires a defined Copilot billing method.

GitHub's documentation identifies another boundary for enterprises using Enterprise Managed Users: agentic autofix is unavailable for user-owned repositories, while non-agentic Copilot Autofix remains available there. For affected teams, the relevant comparison is therefore not just agent versus suggested edit, but which workflow their repository can actually use.

Not yet confirmed

• Per-run AI credit consumption, Actions minutes and the model used by agentic autofix are not established.
• No verified figures establish fix success rates, accuracy or reductions in reviewer workload.
• The Copilot license requirement remains unresolved: the changelog specifies a billing method, while the documentation says a license is unnecessary.
• Availability on Enterprise Server or other plans, and any phased rollout schedule, are not confirmed.
• Agent permissions, sandboxing and safeguards beyond the draft pull request are not established.
• Independent coverage is limited to TechEnclave; a second independent outlet and comparable rival pricing or performance figures are absent.

What to watch

• Published per-run usage figures and identification of the model powering fixes.
• Measured fix acceptance rates and reviewer workload.
• Clarification of licensing requirements and validation coverage.

Related coverage

• AIGitHub Actions retires macOS 14 runners on November 2, with brownouts through October 30
• AIGitHub secret scanning adds detectors for Lovable, Supabase and Pydantic tokens
• AIGitHub Copilot usage reports now show names of custom skills, agents and MCP servers
• AIGitHub adds triage, validity checks, API and webhooks to public monitoring