GitHub agentic autofix now reads Copilot Memory before resolving a security alert and stores successful fix patterns for later work. The same repository memory can inform Copilot code review and the Copilot cloud agent. Both agentic autofix and Copilot Memory remain in public preview. GitHub does not publish outcome or false-positive data for the memory-assisted flow.
GitHub makes agentic autofix generally available for code scanning
2026-09-25Verified announcementTRIAL
GitHub made agentic autofix generally available for CodeQL alerts. Copilot explores the repository, proposes a fix, reruns CodeQL and iterates before opening a draft pull request. Teams can assign one default-branch alert, up to 25 alerts associated with one pull request, or use the REST API. It requires GitHub Code Security or Advanced Security, administrator enablement and a Copilot billing method; work consumes Code Security AI Credits and GitHub Actions minutes.
Official · ReferenceAgentic autofix for code scanning alerts GAReferencegithub.blog · 2026 09 25 agentic autofix now uses copilot memory
Availability: Public Preview
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For security teams, the workflow now closes the loop from alert to validated draft patch instead of stopping at a suggestion. CodeQL reruns are useful evidence, not a guarantee of semantic correctness, so human review and representative tests remain mandatory.
Evidence & related material
GitHub agentic autofix is GA and can explore a repository, generate a fix, rerun CodeQL, iterate and open a draft PR.
Subsequent changes
Agentic autofix moves from public preview to GA
Technical details & scores
| Availability | Public Preview |
|---|---|
| Read Path | agentic autofix consults existing repository memories before creating a fix |
| Write Path | successful fix pattern is stored as a Copilot Memory |
| Consumers | agentic autofix, Copilot code review and Copilot cloud agent |
| Evidence Limit | no published acceptance, regression or false-positive metrics |
| Status | generally available |
| Workflow | repository exploration, patch generation, CodeQL rerun, iteration and draft PR |
| Scope | one default-branch alert or up to 25 alerts associated with one PR; REST API supported |
| Requirements | GitHub Code Security or Advanced Security, admin enablement and Copilot billing method |
| Billing | Code Security AI Credits and GitHub Actions minutes |
Technical impact 3
Engineering value 4
Adoption signal 4
Maturity 2
Verification cost 2
Risk 3