GitHub’s agentic autofix for code scanning alerts is now generally available. The feature lets you assign a security alert to Copilot, which then searches the repository, creates a fix, re‑runs CodeQL to verify the issue is resolved, and opens a draft pull request for review. Engineers caring about security automation, CI efficiency, or AI‑augmented development will see a shift from manual triage to a semi‑automated, AI‑guided remediation loop.
How Agentic Autofix Operates
When an alert on the default branch is assigned to Copilot, the system performs four steps:
- Scans relevant files across the codebase.
- Generates a candidate fix.
- Runs CodeQL again to confirm the alert is closed.
- If needed, iterates until validation passes, then creates a draft pull request containing a summary of the change and the validation evidence.
After the PR appears, you can refine the change by commenting on the PR or using the Agents tab in the repository.
Enabling and Using the Feature
Activation requires two administrative steps:
- An enterprise administrator must turn on the new “Agentic autofix” policy in Advanced Security policies.
- An organization or repository administrator then enables the feature in the Code Security settings.
A valid Copilot billing method must also be configured. Once enabled, the UI replaces the free “Generate Fix” button with an “Assign to Copilot” button on individual alerts. You can also batch‑assign up to 25 alerts from the security alerts list, or invoke the Update a Code Scanning Alert REST API with "assignees": ["copilot-swe-agent[bot]"]. Note that only alerts on the repository’s default branch are eligible; alerts that exist solely on pull‑request branches are ignored.
Operational and Cost Considerations
Agentic autofix consumes two billable resources:
- AI Credits drawn from the Code Security budget.
- GitHub Actions minutes for the CodeQL re‑run and any additional workflow steps.
Usage appears in the enterprise billing UI under the “AI usage” section as part of the “Advanced Security” product line. Organizations can set SKU‑level budgets for these AI credits, providing a guardrail against unexpected spend. Because the feature runs CodeQL scans as part of each fix, expect a modest increase in CI minute consumption proportional to the number of alerts processed.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Practitioners should evaluate the following actions:
- Confirm that the required policy is enabled and that Copilot billing is in place before relying on the feature.
- Audit which repositories have default‑branch‑only alerts, as those are the only ones that can be auto‑fixed.
- Monitor AI Credit and Actions minute usage to ensure budgets align with expected remediation volume.
- Test the batch‑assign workflow on a small set of alerts to understand iteration behavior and PR quality before scaling.
By integrating agentic autofix into existing security pipelines, teams can reduce manual triage effort while retaining review control through draft pull requests. However, the added AI and CI cost dimensions require careful governance to avoid hidden operational overhead.
