What happened
On Oct 15, GitHub took agentic autofix for code scanning alerts to general availability for Code Security and Advanced Security customers on GitHub Enterprise Cloud. Assigning a code scanning alert to Copilot now explores relevant files, proposes a fix, reruns CodeQL to confirm the alert closes, iterates, then opens a draft pull request with an explanation. It can batch up to 25 alerts into one PR, works via the 'Assign to Copilot' button or the REST API (assignee copilot-swe-agent[bot]), and requires the new 'Agentic autofix' enterprise policy plus Copilot billing; usage consumes Code Security AI credits.
Why it matters
This is autonomous remediation (not just detection) shipped GA on the world's largest code-hosting platform, letting teams fix real security alerts across their codebase with machine-validated fixes and a human review gate. It materially changes the AppSec remediation workflow and pairs with the already-GA AI Scan for pull requests.
Applicability
GitHub Advanced Security / Code Security customers on Enterprise Cloud should enable the Agentic autofix policy and evaluate it on default-branch alerts, starting with high-severity findings and reviewing draft PRs before merge.