GitHub announced general availability of agentic autofix for code scanning alerts on October 15, 2026. The feature remediates alerts by working across the codebase the way a developer would: it explores relevant files, proposes a fix, and reruns CodeQL to confirm the fix closes the alert before opening a pull request for review. The announcement page carries a date without a time of day. Read the changelog entry.
How it works
When an alert is assigned to Copilot, it explores relevant files, generates a proposed fix, validates it by rerunning CodeQL, iterates if needed, and then opens a draft pull request. The pull request includes a summary of the fix, why it closes the alert, and the validation steps taken. Further changes can be requested by commenting on the pull request or interacting with the session in the repository's Agents tab.
Ways to use it
- Assign any code scanning alert on the repository's default branch to Copilot; the button replaces the earlier free Generate Fix option when enabled.
- Select up to 25 alerts from the security alert list or a security campaign for Copilot to fix together in a single pull request.
- Use the Update a Code Scanning Alert REST API with the assignee
copilot-swe-agent[bot].
Alerts detected only on pull requests or branches other than the default branch cannot be assigned.
Access
Agentic autofix is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including Enterprise Cloud with data residency. The changelog notes that access requires enterprise administration; billing details follow GitHub's security licensing.
The GitHub Copilot profile lists official entry points; recent Copilot updates are covered in our HydraFusion report.
