GitHub says agentic autofix for code scanning is generally available

On 15 October 2026 at 13:49 UTC, Allison posted Agentic autofix for code scanning alerts general availability on the GitHub Changelog. The post says the feature is now generally available.

What the changelog says Copilot does

When you assign a code scanning alert to Copilot, the changelog says, Copilot explores relevant files, proposes a fix, reruns CodeQL to confirm the fix closes the alert, iterates if needed, and opens a draft pull request. That pull request carries the summary and the validation steps. Later edits are comments, or the session in the Agents tab.

This is limited to alerts on the default branch. Alerts found only on pull requests or other branches cannot be assigned. When the feature is enabled, it replaces the free Generate Fix button on an individual alert with Assign to Copilot. A repository alert list or a security campaign can send up to 25 alerts into one pull request. The Update a Code Scanning Alert API can start the same job by setting assignees to copilot-swe-agent[bot].

The changelog says this is for GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including Enterprise Cloud with data residency. An enterprise administrator enables a new Agentic autofix policy under Advanced Security policies. An organization or repository administrator then turns it on in Code Security settings. The changelog also says access requires a Copilot billing method.

What the linked docs say instead

The concept page linked from the changelog, and the access page linked from that concept page, were opened the same day.

The access page says agentic autofix is available for public repositories on GitHub.com and for organization-owned repositories with GitHub Code Security or GitHub Advanced Security, and that users do not need a GitHub Copilot license. It excludes user-owned repositories in an enterprise that uses Enterprise Managed Users. On that page the enterprise policy only permits organizations to configure the feature. Organization owners and security managers enable it for eligible repositories, on by default, and a repository administrator can opt out. A personal-account public repository can be enabled by its administrator directly. Organizations that used the public preview have to enable it again.

Those two GitHub texts disagree on whether a Copilot billing method is required and on whether public repositories outside Enterprise Cloud are in scope.

The concept page says validation is best effort: Copilot re-runs CodeQL with the code scanning query suite, and that rerun cannot confirm fixes for custom CodeQL queries, the security-extended suite, or third-party alerts. The changelog’s “confirm the fix closes the alert” line does not add that limit.

Credits and Actions minutes

The changelog says each run consumes AI Credits from the Code Security budget and GitHub Actions minutes, shown in enterprise billing under AI usage as the Advanced Security product. SKU-level budgets can be set for those Code Security credits. The changelog states no price per fix, and it does not mention premium requests.

The usage-based billing page it links prices a Copilot AI credit at $0.01 and describes Copilot license pools. It does not name agentic autofix or a Code Security budget. The concept page says each agentic session spends AI credits and Actions minutes, and that older Copilot Autofix suggestions, the Generate Fix path, do not.