News brief · About 2 min read
GitHub's agentic autofix reaches GA with CodeQL validation and separate usage costs
Eligible Enterprise Cloud security customers can assign default-branch alerts to Copilot, with up to 25 alerts per proposed pull request.
- Published here
- Source published
- Source checked
GitHub announced general availability of agentic autofix for code scanning alerts on October 15. It is offered to GitHub Code Security and Advanced Security customers on Enterprise Cloud, including the data-residency version.
Listen to the news
Read this article aloud or keep listening to the news.
Preparing the reader…
Device voice
Speech is handled by your browser or device. AISubHub does not send the text to an audio API. Voice availability and playback with a locked screen vary by device.
Resuming may repeat a short phrase.
At a glance
- Copilot explores files, proposes a fix, reruns CodeQL and iterates if needed, then opens a draft pull request for human review. The PR explains the change and validation; follow-ups can use PR comments or the repository's Agents session.
- It supports default-branch alerts only, not alerts found solely on pull requests or other branches. Users can assign an alert directly, select up to 25 alerts in a repository or security campaign for one PR, or use the update-alert REST API with assignees set to ["copilot-swe-agent[bot]"].
- Enterprise admins must enable the Agentic autofix policy; organization or repository admins then enable the feature in Code Security settings. A Copilot billing method is required.
- When enabled, Assign to Copilot replaces the free Generate Fix option. Agentic autofix consumes Code Security AI Credits and GitHub Actions minutes; enterprise AI usage lists it under Advanced Security, with SKU-level budgets available.
Why it matters
Our interpretation is that rerunning the scanner creates a clearer review trail than accepting an unexplained suggestion. A closed CodeQL alert remains narrower evidence than proving the whole application secure, and the draft PR still requires review.
Limits and availability
These are GitHub's announced capabilities, not an independent security test. This is not free access for every repository. The notice states billing categories but does not supply a universal per-fix price or promise that every alert can be resolved.
Sources and evidence
Source published: · Source checked:
AI-assisted editorial articles checked against linked primary sources. Vendor claims are attributed; inclusion is not endorsement.