Summary
On October 15, 2026, GitHub moved agentic autofix for code scanning alerts to general availability. Copilot explores relevant files, proposes a fix, reruns CodeQL to confirm the alert is closed, and opens a draft pull request. The free 'Generate Fix' option is replaced by 'Assign to Copilot,' and up to 25 alerts can be assigned at once or via the REST API.
What changed
GitHub's agentic autofix for code scanning alerts reached GA: Copilot works across the codebase to remediate alerts, validates each fix by rerunning CodeQL, and opens a draft PR for review. 'Assign to Copilot' replaces the free 'Generate Fix' button; up to 25 alerts can be assigned at once or through the REST API. It is available to GitHub Code Security and Advanced Security customers on Enterprise Cloud, works only on default-branch alerts, and requires admin enablement plus a Copilot billing method.
Why it matters
Moving from single-shot fix suggestions to an agent that iterates across the repo and verifies with CodeQL turns security remediation into a largely autonomous workflow, shifting developer time from writing fixes to reviewing them and raising the bar for agentic security tooling in enterprise pipelines.
Evidence excerpt
Agentic autofix remediates alerts by working across your codebase the way a developer would. Copilot explores relevant files, proposes a fix, and reruns CodeQL to check that the alert is closed, then opens a draft pull request for review.