Agentic autofix is a smarter, more capable way to remediate security alerts with Copilot. Unlike traditional autofix, it doesn’t just suggest a patch; it explores your codebase, validates its own work, and iterates until it’s confident the fix is correct.

How it works

When you assign a code scanning alert to Copilot, it will:

• Explore relevant files across your codebase
• Generate a proposed fix
• Validate the fix by re-running CodeQL, LLM detectors, and linters
• Iterate if needed
• Open a draft pull request for your review

Fix generation typically takes 2–4 minutes.

The resulting pull request includes:

• A summary of the fix
• Why the fix closes the alert
• The validation steps Copilot took to confirm it works

You can also continue working with Copilot after the PR is opened by commenting directly on the pull request or by interacting with the session in the Agents tab of your repository.

Where you can use it

You can trigger agentic autofix in several places:

• From any code scanning alert, by assigning the alert to Copilot
• From the list of security alerts in your repository, by selecting one or more alerts for Copilot to fix together in a single pull request
• Within a security campaign, by selecting one or more alerts for Copilot to fix together in a single pull request
• Via the Update a Code Scanning Alert REST API, by setting assignees to ["copilot-swe-agent[bot]"]

Who can use this

The public preview of agentic autofix requires:

• An active GitHub Code Security or GitHub Advanced Security license
• A Copilot license with Copilot Coding Agent enabled

Agentic autofix uses Copilot usage-based billing, and tool-calling activity also consumes GitHub Actions minutes.

Have questions, feedback, or early impressions? Drop them in the comments below — we’d love to hear what you think.