On October 15, 2026, GitHub made a feature generally available that uses AI to fix and recheck security alerts found by code scanning. Development teams at eligible enterprises can assign alerts to AI and review proposed fixes alongside verification details. The feature checks whether alerts are resolved rather than just suggesting fixes.
1. Pairing fix suggestions with rechecks
With Agentic autofix, Copilot examines relevant repository files, creates a fix, and reruns the CodeQL code scanning tool to check whether the alert is resolved. It repeats edits if needed, then opens a draft pull request for review before the changes are incorporated.
The request includes a summary of the changes, why the fix resolves the alert, and the steps taken to verify it. Teams receive the rationale and verification details, not just changed code.
Once the pull request is ready, teams can request further changes by commenting on it or directing the task session in the repository's agents tab. They can refine the initial fix within the same workflow.
2. Assigning alerts from the alert page and API
Alerts on a repository's default branch can be assigned individually to Copilot. The default branch is the repository's reference branch. From repository or security campaign alert lists, teams can select up to 25 alerts to fix together in one pull request.
For automation, use the REST API for updating code scanning alerts. Set the assignees field, which specifies assignment targets, to the value below. This is the exact value from the source, not a complete request body.
["copilot-swe-agent[bot]"]Support covers code scanning alerts on the default branch. Alerts found only in pull requests or other branches cannot be assigned. Teams planning to process alert lists in bulk must first check that the alerts fall within this scope.
3. Enterprise policies and billing setup are required
The feature is available on GitHub Enterprise Cloud, including environments with data residency.
Eligible customers use GitHub Code Security or GitHub Advanced Security in this environment. Teams must check both their cloud environment and security product usage.
Permission and activation are separate steps. An enterprise admin must first allow the new autofix policy in advanced security policies. An organization or repository admin then enables the feature in the code security settings for that scope. A Copilot payment method must also be configured.
Enabling the feature replaces the existing free fix-generation option on individual alert pages with a button to assign Copilot. Rather than adding a button alongside the existing option, it changes how fixes are initiated for those alerts.
4. Managing usage and review instead of repetitive work
Development teams can delegate file exploration, fixes, and rechecks to the agent. This consumes AI credits from the code security budget and GitHub Actions runtime. It is not the same cost model as free fix generation, but a trade-off between less review preparation work and usage costs.
Credit usage appears under advanced security products in the AI usage section of the enterprise billing and licensing page. Product-level budgets can also be set for code security credits. Admins can check spending controls as well as permissions to enable the feature.
Credit consumption per alert, processing time, and fix success rates were not provided. There is therefore no basis for quantifying cost or time savings.
Rechecks verify whether the specific alert is resolved. The result is a draft for review, so people still decide whether to accept the changes.
The key change is the ability to delegate fixes and rechecks together, while adoption decisions must account for supported scope, usage costs, and human review.