AgentenCode News · October 16, 2026 · Coding agents & application security
GitHub Agentic Autofix reaches general availability
GitHub Copilot can inspect code scanning alerts, validate suggested patches with CodeQL and open draft pull requests for review.
Direct answer
GitHub's agentic autofix is generally available for eligible code scanning alerts. Copilot proposes a correction, reruns CodeQL and opens a draft pull request.
What the vendor actually announced
GitHub announced general availability of agentic autofix for code scanning alerts on October 15, 2026. When an eligible alert is assigned to Copilot, the agent explores relevant files, prepares a proposed patch, reruns CodeQL and opens a draft pull request. Rather than merely explaining a warning, the workflow produces a reviewable change. Developers retain responsibility for evaluating the patch and deciding whether it should eventually be merged into the repository.
The release follows an earlier public preview. GitHub describes an iterative process: the agent may examine related files, update its proposal after validation and document the reasoning inside the pull request. Reviewers can inspect the explanation and steps performed by Copilot. They can also request further adjustments through pull request comments or the repository's Agents tab. A successful CodeQL rerun does not amount to a blanket assurance that the codebase is secure.
The supported alert scope matters. GitHub specifies alerts detected on the repository default branch. Alerts that occur only on pull requests or other branches are not eligible for this assignment flow. Teams can select up to 25 alerts from lists or security campaigns and have Copilot work on them in a combined pull request. The vendor also documents assignment through the code scanning REST API. This is a bounded security workflow, not unrestricted autonomous software development.
Access requires GitHub Enterprise Cloud together with GitHub Code Security or Advanced Security. An enterprise administrator must enable the agentic autofix policy before organization or repository administrators can switch on the feature. GitHub also requires a Copilot billing method. The workflow consumes AI Credits from the Code Security budget and GitHub Actions minutes. General availability therefore should not be mistaken for free access across all GitHub plans.
The value is a traceable handoff from detection to a proposed repair, with a defined validation step. Human code review and other security checks still matter, because addressing one scanning alert is not a comprehensive vulnerability assessment. AgentenCode reports the documented vendor scope and makes no independently measured success-rate or security guarantee.
Frequently asked questions
Are fixes merged automatically?
No. Copilot opens draft pull requests that developers must review.
Does it cover pull-request-only alerts?
No. GitHub documents eligible alerts on the repository default branch.
Official primary source
Vendor claim, not an independently tested guarantee. Verify exact product, plan and region.
GitHub Changelog – Agentic autofix for code scanning alerts general availability ↗ · Vendor date: October 15, 2026
Agent profile / context
GitHub Copilot Coding Agent: related context, verify specific eligibility →