Summary
GitHub launched agentic autofix in public preview for code scanning alerts, letting Copilot explore relevant files across a codebase, propose and validate fixes, and open draft pull requests to remediate security findings.
What changed
On July 10, 2026, GitHub made agentic autofix available in public preview for code scanning alerts. Rather than suggesting a single-line patch, the agent works across the codebase the way a developer would: it explores relevant files, proposes and validates a fix, and opens a draft pull request for review. It operates across repositories, security campaigns, and the REST API.
Why it matters
This moves Copilot from advising on vulnerabilities to autonomously remediating them, closing the loop from detection to a reviewable pull request. Cross-repository and security-campaign support targets the backlog problem in application security, where findings pile up faster than teams can fix them, and positions GitHub Advanced Security as an agentic remediation layer rather than only a scanner.
Evidence excerpt
Agentic autofix is now in public preview for code scanning alerts. It remediates alerts by working across your codebase the way a developer would: it explores relevant files, proposes and validates fixes, and opens draft pull requests.