GitHub announced general availability of agentic autofix for code-scanning alerts on October 15, 2026. Assigning an eligible alert to Copilot starts a workflow that explores the codebase, proposes changes and reruns CodeQL before opening a draft pull request. The release concerns preparing a repair for review, not silently merging a security fix into production.
An agent session differs from a suggested patch
The announcement describes assigning default-branch alerts individually or selecting up to 25 for one pull request. Alerts detected only on a pull request or another branch cannot be assigned through this workflow. The draft includes an explanation and validation steps, giving reviewers evidence to examine rather than only a code diff.
GitHub’s documentation distinguishes agentic autofix from Copilot Autofix. The latter offers a suggested code change for a supported alert; the former investigates more broadly and prepares a draft pull request. They have different access, administration and usage rules. Teams should identify which experience is enabled before assuming the same costs or permissions apply.
Related sources: GitHub: agentic autofix general-availability announcement ↗ · GitHub Docs: autofix for code scanning ↗
What rerunning CodeQL does not establish
The documentation calls agentic autofix best effort. Validation reruns CodeQL with the code-scanning query suite; it cannot confirm fixes for custom CodeQL queries, the security-extended suite or third-party scanning alerts. A detector no longer raising one alert is narrower evidence than complete application security.
AI Speed recommends reviewing authorization behavior, error paths and relevant integration tests alongside the proposed repair. A change can remove an unsafe pattern yet alter expected functionality elsewhere. Require a reviewer who understands the affected component, and retain a rollback route. These are engineering safeguards, not outcomes demonstrated by GitHub’s launch announcement.
Related sources: GitHub Docs: autofix for code scanning ↗
Approve the workflow and its budget separately
The launch describes enterprise and repository-level enablement and a required billing method. It also states that sessions consume Code Security AI Credits and GitHub Actions minutes. The current documentation gives more detailed eligibility and cascading administration rules, which should be checked against the repository’s account type before rollout.
Canadian teams can pilot one confirmed, reproducible alert first. Save the original finding, proposed diff, tests run, reviewer decision and any follow-up defect. Assess accepted fixes that remain correct, not simply how many drafts an agent opens. Do not supply production credentials or expand access merely to let an experimental repair complete.
Related sources: GitHub: agentic autofix general-availability announcement ↗ · GitHub Docs: autofix for code scanning ↗
Sources and editorial method
We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.
- GitHub: agentic autofix general-availability announcement ↗ — October 15, 2026 launch; assignment scope, draft workflow and usage.
- GitHub Docs: autofix for code scanning ↗ — Distinguishes autofix experiences and documents best-effort validation limits; checked October 17, 2026.