GitHub Rolls Out Agentic Autofix for Code Scanning Alerts

On October 15, 2026, GitHub announced general availability of agentic autofix for code scanning alerts. Previously limited to a one-shot suggestion via the “Generate Fix” button, fixing vulnerabilities flagged by CodeQL can now be handed off end-to-end to a Copilot agent, which explores the code, proposes a fix, re-validates it, and then opens a pull request on its own.

#From the “Generate Fix” button to an autonomous agent

Automated vulnerability fixing isn’t new at GitHub: Copilot Autofix for CodeQL has been generally available on public repositories since 2024. What agentic autofix changes is the full loop. The agent explores the relevant files in the repository the way a developer would, generates a fix, reruns CodeQL to confirm the alert is actually closed, iterates if needed, then opens a draft pull request that summarizes the fix, explains why it closes the alert, and lists the validation steps taken.

#How a fix plays out

On an individual alert, an “Assign to Copilot” button replaces the free “Generate Fix” option once the feature is turned on. It only works on alerts present on the repository’s default branch: alerts that exist only on a pull request or another branch can’t be assigned to the agent. Another change: up to 25 alerts can now be selected together, from the security alerts list or a security campaign, to be fixed in a single pull request.

Once the pull request is open, further changes can still be requested by commenting on it directly, or by picking the session back up from the repository’s “Agents” tab. Assignment can also happen through the REST API, which opens the door to wiring this into automated remediation campaigns:

PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
Authorization: Bearer <token>
Content-Type: application/json

{
  "assignees": ["copilot-swe-agent[bot]"]
}

The agent re-validates every fix by rerunning CodeQL before opening its pull request, rather than settling for an unverified suggestion.

#Who can access it

The feature is limited to GitHub Code Security or GitHub Advanced Security customers on GitHub Enterprise Cloud, including with data residency. An enterprise administrator has to turn on the “Agentic autofix” policy in Advanced Security policies first, and then an organization or repository administrator enables it at their level. A Copilot billing method must also be configured.

#Another building block for agents in production

This rollout fits into a broader trend of handing off maintenance tasks to agents that can iterate toward a verifiable result, a subject already covered in our look at editorial agents in production. The difference here lies in what counts as success: unlike editorial content, a CodeQL alert gives a binary signal (closed or not) the agent can loop on automatically, which is why code security is such fertile ground for this kind of automation early on, a pattern covered more broadly in our guide to AI for web developers.

#Key takeaways

• Agentic autofix moves from public preview (July 2026) to general availability on October 15, 2026.
• The agent explores the code, fixes it, re-validates with CodeQL, and opens a draft pull request, on a verified-loop basis rather than a one-off suggestion.
• Up to 25 alerts can be handled together, but only on the default branch.
• Access requires GitHub Advanced Security, Enterprise Cloud, and a two-level activation (enterprise, then organization or repository).
• Usage is billed in AI Credits, separate from the free “Generate Fix” option, which still exists.

Further reading: the official announcement on the GitHub changelog.