GitHub’s agentic autofix preview is a useful security signal because it moves AI from advisory output into the remediation workflow. GitHub says agentic autofix is now in public preview for all code scanning alerts, including alerts generated by CodeQL and third-party scanning tools. It explores relevant files, proposes a fix, reruns the original analysis to confirm the alert is closed, and then opens a draft pull request for human review.
The operating model is concrete. Agentic autofix requires GitHub Code Security or GitHub Advanced Security, a Copilot license, and Copilot cloud agent enabled. Users can assign a single alert to Copilot, select multiple alerts from the security alert list, use it within a security campaign, or trigger it through the REST API by assigning the alert to copilot-swe-agent[bot]. GitHub says fix generation typically takes two to four minutes. The draft pull request includes a summary of the fix, an explanation of why it closes the alert, and the validation steps Copilot performed.
Grey Haven’s read: AI security is moving from finding problems to producing reviewable change sets. That is a major workflow shift. The constraint is no longer just detection accuracy. It is whether the agent can understand enough repository context, modify the right files, validate the result, and leave a review trail that security and engineering teams can trust.
Operators should treat this as assisted remediation, not autonomous patching. Start with lower-risk repositories, require human PR review, track false fixes, watch for test gaps, and measure whether alerts close faster without increasing regression risk. Billing also belongs in the rollout plan: the preview consumes AI Credits when a fix runs and can consume GitHub Actions minutes during validation.
The watch item is campaign-scale remediation. If agents can fix groups of related alerts safely, security backlogs become workflow queues. If validation is shallow, teams may just convert alert debt into review debt.
Source: GitHub Changelog, “Agentic autofix for code scanning alerts in public preview,” July 10, 2026.
