The AI Toolcast.

AI tool news. Practical perspective.

Follow with RSS

GitHub’s agentic autofix reaches general availability for security alerts

The tool investigates code-scanning alerts and prepares draft fixes. Administrators must enable access, preview organizations must opt in again, and runs consume AI credits plus Actions minutes.

BriefAgent tools2 min read

By AI Toolcast deskSource review · AI-assisted
View sources
In this article
  1. Quick answers
  2. From security alerts to draft fixes
  3. Enablement and access
  4. Costs and validation limits
  5. Sources & method

Quick answers

What changed?

GitHub announced general availability on October 15. Organizations that used agentic autofix during the public preview must enable it again.

Source 1 Source 3

Who can use agentic autofix?

Current documentation lists public GitHub.com repositories and organization-owned repositories with Code Security or Advanced Security. No Copilot license is required. Personal repositories of Enterprise Managed Users are excluded.

Source 3

Is agentic autofix free for public repositories?

Public repositories still consume Code Security AI Credits, and sessions use GitHub Actions minutes. Without an included credit allowance, AI usage is metered.

Source 2 Source 4

The practical takeaway

Agentic autofix can turn security alerts into reviewable patches, but its validation limits and usage costs determine where it fits.

From security alerts to draft fixes

GitHub made agentic autofix generally available on October 15. Developers assign code-scanning alerts to Copilot, which GitHub says examines the repository, proposes changes, reruns CodeQL and prepares a draft pull request for review. It accepts alerts on the default branch, including batches of up to 25; alerts found only in pull requests or other branches are excluded.

Existing Copilot Autofix provides a suggested change for an individual alert. Our reading is that the agentic workflow targets a different bottleneck: turning a backlog of security findings into patches that reviewers can assess.

Source 1Source 2

Enablement and access

GitHub’s launch notice names Enterprise Cloud customers, including those using data residency. Its current access documentation also lists public GitHub.com repositories and organization-owned repositories with Code Security or Advanced Security. A Copilot license is unnecessary; personal repositories of Enterprise Managed Users are excluded.

Administrators must enable access. Enterprise organizations need both enterprise permission and organization enablement; organizations that used the preview must enable it again. The announcement also requires a Copilot billing method.

Source 1Source 3

Costs and validation limits

Sessions use Code Security AI Credits and GitHub Actions minutes. Public repositories still consume credits. Eligible included credits are used first; without an allowance, usage is metered.

GitHub cautions that the agent cannot confirm repairs for third-party alerts, custom CodeQL queries or the security-extended query suite. That limits what a successful automated check establishes. The practical value is a prepared repair and its explanation; reviewers still need to test the change before merging.

Source 2Source 4

Sources & method

Reporting from GitHub’s October 15 announcement and current documentation, with original analysis. We have not tested the feature or verified individual accounts.

  1. GitHub: Agentic autofix for code scanning alerts general availabilityPublished October 15, 2026
  2. GitHub Docs: About autofix for code scanningAccessed October 18, 2026
  3. GitHub Docs: Managing access to agentic autofix for code scanningAccessed October 18, 2026
  4. GitHub Docs: GitHub Advanced Security license billingAccessed October 18, 2026

Source pages reviewed October 18, 2026. Analysis and suggested evaluation methods are AI Toolcast’s own.

Prepared with AI assistance from primary sources. This article contains no sponsored placement or affiliate links.

Keep reading