[{"data":1,"prerenderedAt":374},["ShallowReactive",2],{"blog-2026-07-18-github-agentic-autofix-code-scanning":3},{"id":4,"title":5,"author":6,"body":7,"date":358,"description":359,"extension":360,"language":361,"meta":362,"navigation":363,"path":364,"seo":365,"stem":366,"tags":367,"__hash__":373},"blog/blog/2026-07-18-github-agentic-autofix-code-scanning.md","GitHub Turns Code Scanning Alerts into Agent Tasks","NeoAI",{"type":8,"value":9,"toc":350},"minimark",[10,14,45,48,53,77,97,111,122,126,143,170,179,183,186,195,198,201,204,208],[11,12,13],"p",{},"Security tools are good at finding problems. The hard part is getting those problems fixed without drowning developers in alert queues.",[11,15,16,17,21,22,25,26,38,39],{},"On ",[18,19,20],"strong",{},"July 10, 2026",", GitHub announced that ",[18,23,24],{},"agentic autofix for code scanning alerts"," is now in public preview.",[27,28,29],"sup",{},[30,31,37],"a",{"href":32,"ariaDescribedBy":33,"dataFootnoteRef":35,"id":36},"#user-content-fn-1",[34],"footnote-label","","user-content-fnref-1","1"," The feature lets teams assign code scanning alerts to Copilot. Copilot then explores the relevant parts of the repository, proposes a fix, reruns the original analysis to check whether the alert is closed, iterates if needed, and opens a draft pull request for review.",[27,40,41],{},[30,42,37],{"href":32,"ariaDescribedBy":43,"dataFootnoteRef":35,"id":44},[34],"user-content-fnref-1-2",[11,46,47],{},"That is a meaningful shift in how application security work is packaged. Traditional code scanning turns vulnerabilities and quality issues into tickets or pull request annotations. Classic autofix can suggest a patch for a specific finding. Agentic autofix moves one step further: the alert becomes a bounded engineering task for a cloud agent.",[49,50,52],"h2",{"id":51},"what-actually-changed","What actually changed",[11,54,55,56,59,60,63,64,70,71],{},"GitHub says the new public preview applies to code scanning alerts generated by ",[18,57,58],{},"CodeQL"," and by ",[18,61,62],{},"third-party scanning tools",".",[27,65,66],{},[30,67,37],{"href":32,"ariaDescribedBy":68,"dataFootnoteRef":35,"id":69},[34],"user-content-fnref-1-3"," The changelog was updated on July 16 to clarify that coverage.",[27,72,73],{},[30,74,37],{"href":32,"ariaDescribedBy":75,"dataFootnoteRef":35,"id":76},[34],"user-content-fnref-1-4",[11,78,79,80,86,87,90,91],{},"When a user assigns an alert to Copilot, GitHub describes the workflow as four steps: Copilot explores relevant files, generates a proposed fix, validates the change by rerunning CodeQL, and opens a draft pull request ready for human review.",[27,81,82],{},[30,83,37],{"href":32,"ariaDescribedBy":84,"dataFootnoteRef":35,"id":85},[34],"user-content-fnref-1-5"," GitHub says fix generation typically takes ",[18,88,89],{},"2 to 4 minutes",", and the pull request includes a summary of the fix, why it closes the alert, and the validation steps Copilot performed.",[27,92,93],{},[30,94,37],{"href":32,"ariaDescribedBy":95,"dataFootnoteRef":35,"id":96},[34],"user-content-fnref-1-6",[11,98,99,100,63,104,110],{},"The feature can be triggered from an individual code scanning alert, from a repository's security alert list, from a security campaign, or through the REST API by setting the assignee to ",[101,102,103],"code",{},"copilot-swe-agent[bot]",[27,105,106],{},[30,107,37],{"href":32,"ariaDescribedBy":108,"dataFootnoteRef":35,"id":109},[34],"user-content-fnref-1-7"," Bulk assignment is important because security backlogs are often not one-alert-at-a-time problems.",[11,112,113,114],{},"GitHub's docs describe the same model from the user side: assigning an alert starts an agent session where Copilot explores the codebase, generates a fix, validates it, and opens a pull request.",[27,115,116],{},[30,117,121],{"href":118,"ariaDescribedBy":119,"dataFootnoteRef":35,"id":120},"#user-content-fn-2",[34],"user-content-fnref-2","2",[49,123,125],{"id":124},"the-access-and-billing-boundaries","The access and billing boundaries",[11,127,128,129,132,133,136,137],{},"This is not a free, always-on repair bot. The public preview requires an active ",[18,130,131],{},"GitHub Code Security"," or ",[18,134,135],{},"GitHub Advanced Security"," license, plus a Copilot license with Copilot cloud agent enabled.",[27,138,139],{},[30,140,37],{"href":32,"ariaDescribedBy":141,"dataFootnoteRef":35,"id":142},[34],"user-content-fnref-1-8",[11,144,145,146,149,150,156,157,163,164],{},"Billing is also explicit. During the preview, agentic autofix consumes the organization's ",[18,147,148],{},"AI Credits"," when a fix runs on an assigned alert, and GitHub says the usage is not itemized separately from other Copilot activity during public preview.",[27,151,152],{},[30,153,37],{"href":32,"ariaDescribedBy":154,"dataFootnoteRef":35,"id":155},[34],"user-content-fnref-1-9"," The work also consumes GitHub Actions minutes.",[27,158,159],{},[30,160,37],{"href":32,"ariaDescribedBy":161,"dataFootnoteRef":35,"id":162},[34],"user-content-fnref-1-10"," GitHub's docs similarly state that each agentic autofix session is billed as a Copilot cloud agent session and consumes AI credits.",[27,165,166],{},[30,167,121],{"href":118,"ariaDescribedBy":168,"dataFootnoteRef":35,"id":169},[34],"user-content-fnref-2-2",[11,171,172,173],{},"Admins keep policy controls. Repository and organization admins can turn Copilot Autofix off in settings, and enterprise admins can disable it by policy. GitHub notes that when the policy disables it, both the classic and agentic autofix experiences are disabled.",[27,174,175],{},[30,176,37],{"href":32,"ariaDescribedBy":177,"dataFootnoteRef":35,"id":178},[34],"user-content-fnref-1-11",[49,180,182],{"id":181},"why-this-matters","Why this matters",[11,184,185],{},"The interesting part is not that an LLM can propose a patch. That has been true for a while. The important change is the closed loop around a specific security finding: read the code, make the change, rerun the analyzer, and deliver the result as a normal pull request.",[11,187,188,189],{},"For engineering teams, that fits existing review workflows better than a chat transcript or a detached suggestion. A draft pull request can be inspected, tested, commented on, rejected, or merged. Developers can ask Copilot for further changes by commenting on the pull request or using the repository's Agents tab.",[27,190,191],{},[30,192,37],{"href":32,"ariaDescribedBy":193,"dataFootnoteRef":35,"id":194},[34],"user-content-fnref-1-12",[11,196,197],{},"For application security teams, the appeal is obvious but bounded. Agentic autofix may reduce the mechanical work of tracing and patching common findings. It does not remove the need for review, threat modeling, or judgment about whether a patch preserves product behavior. GitHub itself positions the output as a pull request for review, not an automatic merge.",[11,199,200],{},"The broader pattern is still clear: security scanners are becoming inputs for software agents. Alerts are no longer just static reports. They can now trigger a constrained repair workflow with validation evidence attached.",[11,202,203],{},"That is probably where agentic developer tools are most useful today: not replacing engineering judgment, but taking a well-defined piece of work, running the boring loop, and handing back something a human can review.",[49,205,207],{"id":206},"sources","Sources",[209,210,213,218],"section",{"className":211,"dataFootnotes":35},[212],"footnotes",[49,214,217],{"className":215,"id":34},[216],"sr-only","Footnotes",[219,220,221,328],"ol",{},[222,223,225,226,232,233,240,241,240,248,240,256,240,264,240,272,240,280,240,288,240,296,240,304,240,312,240,320],"li",{"id":224},"user-content-fn-1","GitHub Changelog, ",[30,227,231],{"href":228,"rel":229},"https://github.blog/changelog/2026-07-10-agentic-autofix-for-code-scanning-alerts-in-public-preview/",[230],"nofollow","\"Agentic autofix for code scanning alerts in public preview\"",", published July 10, 2026. ",[30,234,239],{"href":235,"ariaLabel":236,"className":237,"dataFootnoteBackref":35},"#user-content-fnref-1","Back to reference 1",[238],"data-footnote-backref","↩"," ",[30,242,239,246],{"href":243,"ariaLabel":244,"className":245,"dataFootnoteBackref":35},"#user-content-fnref-1-2","Back to reference 1-2",[238],[27,247,121],{},[30,249,239,253],{"href":250,"ariaLabel":251,"className":252,"dataFootnoteBackref":35},"#user-content-fnref-1-3","Back to reference 1-3",[238],[27,254,255],{},"3",[30,257,239,261],{"href":258,"ariaLabel":259,"className":260,"dataFootnoteBackref":35},"#user-content-fnref-1-4","Back to reference 1-4",[238],[27,262,263],{},"4",[30,265,239,269],{"href":266,"ariaLabel":267,"className":268,"dataFootnoteBackref":35},"#user-content-fnref-1-5","Back to reference 1-5",[238],[27,270,271],{},"5",[30,273,239,277],{"href":274,"ariaLabel":275,"className":276,"dataFootnoteBackref":35},"#user-content-fnref-1-6","Back to reference 1-6",[238],[27,278,279],{},"6",[30,281,239,285],{"href":282,"ariaLabel":283,"className":284,"dataFootnoteBackref":35},"#user-content-fnref-1-7","Back to reference 1-7",[238],[27,286,287],{},"7",[30,289,239,293],{"href":290,"ariaLabel":291,"className":292,"dataFootnoteBackref":35},"#user-content-fnref-1-8","Back to reference 1-8",[238],[27,294,295],{},"8",[30,297,239,301],{"href":298,"ariaLabel":299,"className":300,"dataFootnoteBackref":35},"#user-content-fnref-1-9","Back to reference 1-9",[238],[27,302,303],{},"9",[30,305,239,309],{"href":306,"ariaLabel":307,"className":308,"dataFootnoteBackref":35},"#user-content-fnref-1-10","Back to reference 1-10",[238],[27,310,311],{},"10",[30,313,239,317],{"href":314,"ariaLabel":315,"className":316,"dataFootnoteBackref":35},"#user-content-fnref-1-11","Back to reference 1-11",[238],[27,318,319],{},"11",[30,321,239,325],{"href":322,"ariaLabel":323,"className":324,"dataFootnoteBackref":35},"#user-content-fnref-1-12","Back to reference 1-12",[238],[27,326,327],{},"12",[222,329,331,332,337,338,240,343],{"id":330},"user-content-fn-2","GitHub Docs, ",[30,333,336],{"href":334,"rel":335},"https://docs.github.com/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts",[230],"\"Resolving code scanning alerts\"",", accessed July 18, 2026. ",[30,339,239],{"href":340,"ariaLabel":341,"className":342,"dataFootnoteBackref":35},"#user-content-fnref-2","Back to reference 2",[238],[30,344,239,348],{"href":345,"ariaLabel":346,"className":347,"dataFootnoteBackref":35},"#user-content-fnref-2-2","Back to reference 2-2",[238],[27,349,121],{},{"title":35,"searchDepth":351,"depth":351,"links":352},2,[353,354,355,356,357],{"id":51,"depth":351,"text":52},{"id":124,"depth":351,"text":125},{"id":181,"depth":351,"text":182},{"id":206,"depth":351,"text":207},{"id":34,"depth":351,"text":217},"2026-07-18","GitHub's new agentic autofix public preview lets Copilot investigate code scanning alerts, validate fixes with CodeQL, and open draft pull requests for human review.","md","en",{},true,"/blog/2026-07-18-github-agentic-autofix-code-scanning",{"title":5,"description":359},"blog/2026-07-18-github-agentic-autofix-code-scanning",[368,369,370,371,372],"AI","Developer Tools","GitHub Copilot","Security","Software Development","vFRiEWnfPGr6tXWYm9URL4zo1fcdnaFsBQQNBY9DjHU",1789790494099]