GitHub moved Agentic Autofix to general availability on October 15.

In one line:

Assign an alert to Copilot
→ it explores the codebase
→ generates a fix
→ reruns CodeQL to validate
→ iterates if needed
→ opens a draft pull request

It arrived in public preview on July 10, so this is roughly a three-month path to GA. The road was busy: July 16 widened assignment to third-party scanner alerts, September 9 brought bulk fixing of up to 25 Code Quality findings, and September 25 wired in Copilot Memory so the agent remembers repository-specific secure patterns.

This article walks through what GA changed, how the flow actually works, and how far the validation can be trusted.

What changed between preview and GA

The mechanics are unchanged, but the gates are now explicit.

Individual alert view
  Before: Generate Fix (free static suggestion)
  Now:    Assign to Copilot (agent investigates, fixes, validates)

Availability
  GitHub Enterprise Cloud (including data residency)
  GitHub Code Security or GitHub Advanced Security customers

Turn-on path
  Enterprise admin enables the "Agentic autofix" policy
  → org or repo admin enables it in Code Security settings
  → a Copilot billing method must be defined

The practical difference is that this stops being a per-repo toggle and becomes a policy-gated capability. For a security feature, that is the right direction: administrators hold the switch.

How it works: a developer workflow, in order

Assign one alert and this happens:

1. Explore    — reads the codebase beyond the alert's file
2. Generate   — proposes a fix, following repo custom instructions
3. Validate   — reruns CodeQL to confirm the alert closes
4. Iterate    — repairs and retries when validation fails
5. Open PR    — draft PR with fix summary, closure rationale, validation steps

The pull request is a review artifact, not an autopilot merge. You can keep working with Copilot by commenting on the PR or continuing the session from the repository's Agents tab. Per preview guidance, fix generation typically takes two to four minutes.

There are three ways to assign work:

1. Assign a single alert from its page
2. Select up to 25 alerts in the alert list or a security campaign → one PR
3. REST API: set assignees to ["copilot-swe-agent[bot]"]

One constraint stands out: only alerts on the default branch can be assigned. Alerts detected only on pull requests or other branches are out of scope. This is a tool for burning down the default-branch backlog, not for blocking issues before merge.

Example: handing over a path traversal alert

A small example to build intuition. Code like this draws a CodeQL alert for untrusted input reaching a path expression.

# The alerted code
from flask import request

@app.get("/files")
def read_file():
    name = request.args.get("name", "")
    with open(f"/data/reports/{name}") as f:  # path traversal risk
        return f.read()

A fix Copilot might produce looks roughly like this.

# One plausible fix (actual output varies by context)
from pathlib import Path
from flask import request, abort

BASE = Path("/data/reports").resolve()

@app.get("/files")
def read_file():
    name = request.args.get("name", "")
    target = (BASE / name).resolve()
    if target != BASE and BASE not in target.parents:
        abort(404)
    return target.read_text()

The code matters less than what comes with it. The PR carries not only the change but why it closes the alert and what validation Copilot ran. When validation fails, the agent retries; when it still can't confirm, the PR records that too.

Know exactly what the validation covers

This is the most important section of this article.

Copilot's validation is execution, not assertion: it actually reruns CodeQL and checks that the alert no longer fires. That is a different category of evidence from a model saying "I verified it." But GitHub's documentation draws the boundary clearly.

Validated
  Alerts covered by the default code-scanning query suite

Not guaranteed
  Alerts from custom queries
  Alerts from the security-extended query suite
  Fix quality for third-party tool alerts
  → the feature itself is described as best-effort

So "CodeQL passes" means this tool no longer flags it — not "this vulnerability is proven gone." Static analysis has false negatives, and it does not understand your business logic.

This echoes the question from our Grok 4.7 self-verification piece, with one upgrade: this is an external tool being rerun, not a model reviewing itself. Better evidence, same rule — the tool cannot see what it cannot see. Human review stays in the pipeline.

Billing: AI Credits plus Actions minutes

GA also made the cost path explicit.

Charged: AI Credits (from the Code Security budget) + GitHub Actions minutes
Shown as: "Advanced Security" product in enterprise billing AI usage
Controls: SKU-level budgets supported
Requires: a defined Copilot billing method

Agent sessions consume tokens and compute time, so large batches like 25-alert runs cost accordingly. Budget for this differently from the free static suggestions it replaces.

CodeBridge mini lab: a 10-minute check

If you carry a security backlog, check these:

[ ] Is code scanning (CodeQL) running on the default branch?
[ ] Do CI tests run on PRs (the second safety net for AI fixes)?
[ ] Do you know the enterprise policy and repo setting state?
[ ] Who reviews AI-generated security PRs, against what criteria?
[ ] Is a Code Security AI Credits budget cap set?
[ ] Are custom or third-party query alerts handled separately?

The fourth item is the core one. This feature produces PRs that are reviewable; it does not replace review.

Conclusion: investigation was the bottleneck, not fixing

The backlog bottlenecked on investigation, not edit time,
is turning into a queue of verifiable pull requests.

The meaningful change is not speed but the shape of the evidence: not "AI fixed it," but "we reran CodeQL, here is the result, here is the PR." Humans still read and judge that evidence — PR review becomes security's new front line.

If you do one thing this week, assign a single old default-branch alert and read the resulting PR. That one artifact tells you whether this fits your team, for the price of one experiment.

Further reading

References

Go deeper with a course

Handing code to an agent and validating the result through pull requests is exactly the muscle the Copilot course builds. Practice Agent and Plan modes on a real project, tests included.