Assigning Vulnerabilities to Copilot to “Just Fix It”—GitHub's Agentic Autofix Checks Its Own Work with CodeQL Before Opening a PR
On October 15, GitHub made Agentic Autofix—which automatically remediates code scanning alerts—generally available. The agent explores the codebase to apply fixes, re-runs CodeQL to confirm for itself whether the alert is closed, and only then opens a draft PR. It supports bulk remediation of up to
Picture assigning the vulnerabilities listed in your security alerts to Copilot, the same way you'd hand them off to a teammate. On October 15, 2026, GitHub made Agentic Autofix—which automatically remediates code scanning alerts—generally available (GA). Rather than merely suggesting a fix, the agent investigates the repository, applies the changes, re-runs CodeQL to confirm for itself whether the alert is actually gone, and only then opens a draft pull request (PR). The crux of this release is that it runs this entire sequence without human intervention.
“Assign to Copilot” Turns an Alert into a Fix
Until now, Copilot Autofix presented a candidate patch for each individual alert—“change this line like so.” Agentic Autofix takes a step further, shifting into a workflow that explores related files across the entire codebase, not just the immediate vicinity of a single alert, and sees the fix through to the end.
The starting point is simple: just click the “Assign to Copilot” button on the alert screen. From a security campaign list, you can also bundle up to 25 alerts into a single PR for remediation. The same process runs via the REST API as well—just specify copilot-swe-agent[bot] as the assignee. It isn't limited to CodeQL detections, either: alerts from third-party tools ingested via SARIF can also be assigned.
Not Just Fixing, but Confirming the Alert Is Closed
Once assigned, the agent goes through the following steps before presenting its results.
- Exploration: Comb through the codebase to identify files related to the alert.
- Drafting a fix: Assemble a fix spanning multiple files, just as a developer would.
- Re-verification: Run CodeQL again to verify that the fix actually closes the alert. If it doesn't, rework the fix.
- Opening a draft PR: Open a draft PR for review, accompanied by a summary of the changes, why the alert is closed, and the verification steps performed.
It doesn't stop at making the fix—the agent confirms for itself that “the fix passes the detector” before handing it over to a human. This verification loop is the biggest difference from the patch suggestions of old.
Where—and at What Cost—Can You Use It
The requirements and billing are as follows. This is a reconstruction, so please check the sources for the exact scope.
| Item | Details |
|---|---|
| Eligible plans | GitHub Code Security / GitHub Advanced Security (Enterprise Cloud, including the data residency option) |
| Enablement | An Enterprise admin allows the “Agentic autofix” policy → an org/repository admin enables it in Code Security settings. A Copilot payment method is required |
| Billing | Consumes AI credits from the Code Security budget plus GitHub Actions runtime. Charges are recorded as “Advanced Security” |
| Scope constraints | Only alerts on the default branch are supported. Alerts on PRs or specific to a branch cannot be assigned |
The “default branch only” boundary matters in practice. For now, you can't have the agent fix an alert detected on a feature branch right there on the spot.
“Silencing the Detector” Is Not the Same as Passing
As you automate remediation, the burden shifts from “writing” to “verifying.” The concern raised here is the possibility that the agent satisfies the detector while breaking legitimate behavior. One assessment cites a case where “the alert disappeared, yet valid customer processing began to fail on the same input.” If closing the alert is your only criterion for success, a superficially clean PR could slip through while still hiding a fundamental defect.
Reviewers are expected to confirm things like why each changed file is involved in the fix, and which revision the verification summary refers to (once the branch moves, past verification can become invalid). It's also worth noting that AI analysis is, in most cases, advisory only—it doesn't automatically block a merge.
The more code generation is automated, the more review becomes the new bottleneck—a pattern that research has repeatedly pointed out, finding that shipping volume didn't rise even as the amount of AI-generated code grew. Agentic Autofix has pushed the agent all the way to “fix and check its own work,” but it's closer to reality to see it as leaving the responsibility for the final call on whether it's truly correct still with humans.
References: GitHub Changelog, “Agentic autofix for code scanning alerts general availability” / GitHub Docs, “About autofix for code scanning” / DEV, “AI Autofix Changes What a Pull Request Must Explain” / WindowsForum, “GitHub Agentic Autofix GA”
