Daily⁠ · Oct 15, 2026⁠ · Copilot · 🌶️🌶️Worth a look

Copilot will now fix your security warnings for you

Copilot can now fix your security alerts and prove it.

Assign a CodeQL alert and it patches the code, re-runs CodeQL to prove the alert is gone, then opens a draft PR. Up to 25 alerts per batch. Now GA.

Default-branch alerts only: an enterprise admin has to turn on the “Agentic autofix” policy, and each run spends Code Security AI Credits + Actions minutes. You can also start it via the REST API (copilot-swe-agent[bot]).

What changed

Got a pile of security alerts? You can now hand them to Copilot and get back a checked fix as a draft pull request.

What changed

GitHub made agentic autofix for code scanning alerts generally available on Oct 15, 2026. Code scanning (CodeQL) flags risky code in your repository.

Now you can assign one of those alerts to Copilot: it explores the relevant files, proposes a fix, reruns CodeQL to confirm the alert is closed, and then opens a draft pull request for your review.

The pull request explains the fix, why it closes the alert, and the checks Copilot ran.

How to use it

On any code scanning alert on your default branch, choose "Assign to Copilot".
In the alert list, select up to 25 alerts and Copilot fixes them together in one pull request.
From scripts, use the REST API: set assignees to ["copilot-swe-agent[bot]"] on the alert.
Want changes? Comment on the pull request, or open the session in your repository’s Agents tab.

Before you start

It’s for GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud.
An enterprise admin has to enable the new "Agentic autofix" policy. Then an organization or repository admin turns it on in Code Security settings, and a Copilot billing method must be set.
Only alerts on the default branch can be assigned, not alerts found only on pull requests or other branches.
Each run uses AI Credits from your Code Security budget plus GitHub Actions minutes.
Once enabled, it replaces the Generate Fix option on individual alerts.

Source: GitHub Changelog