Michael JohnsonOn October 15, 2026, GitHub announced general availability of Agentic Autofix for Code Scanning alerts. Copilot investigates the codebase related to an issue, proposes a fix, and validates the changes; it then opens a draft pull request for developer review. This connects an automated finding to a code change prepared for review.
Agentic Autofix can be assigned to alerts in the to-do list for the default branch. GitHub also describes assigning one or more alerts, including through a security campaign. The documentation says that assigning an alert starts a separate agent session for each one.
What the agent actually checks
According to the Agentic Autofix availability announcement, Copilot can investigate files related to an issue beyond the file flagged by the scanner, create a patch, and open a pull request describing the change. The team can review the proposed diff, request revisions, or reject it.
For validation, GitHub reruns CodeQL with the code scanning query suite. This check cannot confirm a fix for alerts from custom CodeQL queries, the security-extended query suite, or third-party tools. In these cases, the team needs to assess the result independently; GitHub recommends reviewing and testing generated changes before merging.
Access and costs depend on configuration
Availability depends on repository type and the connected product. GitHub documentation says Agentic Autofix is available for eligible organization repositories on GitHub Team or GitHub Enterprise Cloud with GitHub Code Security enabled, as well as eligible public repositories owned by personal accounts. Access must be allowed at the organization level and, if the organization belongs to an enterprise, at the enterprise level; repository administrators can manage the setting within the limits of those policies.
Each Agentic Autofix session uses AI Credits for Code Security and GitHub Actions minutes. Before starting, check which repositories are eligible, who can assign alerts, and how the team will account for these costs. The separate Copilot Autofix feature suggests one change for an individual alert and follows a different process.
A practical starting point is to assign the agent several suitable alerts on the default branch, then review the diff, CodeQL results, and resource usage. Agentic Autofix prepares a fix and a draft pull request; the team reviews the change and decides whether it can be merged.