The report
GitHub made agentic autofix for code-scanning alerts generally available on October 15, 2026. For an eligible alert, Copilot can inspect repository context, prepare a proposed repair, run the relevant CodeQL check and open a draft pull request. GitHub says the feature supports batches of up to 25 alerts. The agent does not independently merge those changes.
What is available
The feature uses a Code Security administrator policy and repository-level enablement, with Copilot billing configured. GitHub states that usage consumes Code Security AI credits and GitHub Actions minutes. These are workflow and cost controls rather than a measured reduction in exploited vulnerabilities. The rollout provides a route from scanner finding to a reviewable patch, but it does not certify the patch as safe.
The stage boundary matters. The original CodeQL alert may disappear because the implicated code path has changed, but that alone cannot establish that the underlying security condition is eliminated. An alternative exploit path may survive, or a fix may suppress the proof without maintaining legitimate behavior. In independent research, P2Patch identified residual exploit variants after initial attempted repairs. A separate benchmark evaluation showed that patches could stop a supplied proof of concept while failing developer-maintained functionality tests. Neither measured this GitHub feature's new production cohort.
What a completed repair would require
The draft pull request gives a maintainer an opportunity to inspect exactly what changed. A meaningful closure record should associate the original finding with the reviewed commit, confirm that the reproduced weakness is blocked, run relevant functionality tests and record any remaining unsupported variants. Batched repairs introduce an additional question: whether two fixes interact through the same dependency or API contract. An automatically generated explanation is not an independent test outcome.
The announced general availability is a product milestone, not a verified exploit-closure statistic. GitHub has published the mechanism, administrative controls and billing model; a comparable independent assessment of true vulnerability removal, regressions and maintainer review effort remains the missing evidence.