On 15 October 2026 GitHub announced that agentic autofix for code scanning alerts is generally available. An alert is a security warning raised against code. Assign one to Copilot and it reads the relevant files, proposes a fix, re-runs GitHub’s CodeQL scanner to check the warning has gone, then opens a draft pull request with a summary of what it did and how it checked.
What GitHub says it does
- You can assign a single alert, or select up to 25 alerts to be fixed together in one pull request.
- Only alerts on the repository’s default branch can be assigned.
- It is available to GitHub Code Security and Advanced Security customers on GitHub Enterprise Cloud.
- Three things must be in place before it works: an enterprise policy switched on, a repository or organisation setting enabled, and a Copilot billing method.
The bill
This is not free. Usage consumes AI credits from the Code Security budget plus GitHub Actions minutes, and appears in enterprise billing under “Advanced Security”. When agentic autofix is on, it replaces the free “Generate fix” option with an “Assign to Copilot” button. Administrators can set budgets, which matters because bulk fixing is exactly the kind of work that can run up a bill quietly.
Why this matters outside engineering
Security backlogs are one of the most common reasons software gets slower to change. A tool that clears routine alerts in draft pull requests shortens that backlog. But a draft is still a draft. The fix passes the scanner, which is not the same as being right for your product, and a human still has to read it before it ships.
So what
If you are commissioning software, two questions are worth asking your supplier. Who reviews AI-written security fixes before they merge? And are AI usage costs inside the quote, or passed through as extras? A supplier using AI well will answer both in a sentence.
That is the standard we hold ourselves to in AI-assisted development at BuildApps: AI does the routine work, named people are accountable for what ships. To talk through your own project, start a project.