Agentic autofix is generally available: what the CodeQL re-run proves, and what it doesn't

Assigning a code scanning alert to Copilot now ends in a draft pull request that says CodeQL was re-run and the alert closed. That sentence is true, and it is narrower than it sounds. Agentic autofix reached general availability on 15 October 2026, so it’s worth knowing exactly what the check covers before a reviewer starts waving these PRs through.

GitHub’s changelog describes the loop: Copilot explores relevant files, generates a fix, reruns CodeQL to confirm the fix closes the alert, iterates if needed, then opens a draft pull request. The PR carries a summary, the reasoning for why the alert closes, and the validation steps taken. What follows is documented behaviour, not observed behaviour: agentic autofix needs an Enterprise Cloud organisation with a Code Security or Advanced Security licence.

What changed since the preview

The public preview landed on 10 July 2026. Comparing the preview changelog with the GA one and the current docs turns up a few differences that matter.

Access is now policy-driven. An enterprise administrator has to switch on a new “Agentic autofix” policy in Advanced Security policies, after which an organisation or repository administrator can enable it. A Copilot billing method must be defined. The preview announcement asked for a Copilot licence with the cloud agent enabled, while the autofix concepts page now says you don’t need a Copilot licence to use it. The two pages don’t read identically on eligibility, so check the current one for your plan.

Batching has a ceiling. The resolve-alerts docs say you can select up to 25 alerts from the backlog or a security campaign, and one assignment creates one agent session and one pull request. That detail matters for reviewers: 25 alerts in one PR is a large diff to approve on the strength of a summary.

The scope is the default branch. Alerts found only on a pull request or another branch can’t be assigned.

What the re-run proves

When the CodeQL re-run passes, the specific alert no longer fires on the new code, using the standard code scanning query suite. That’s a real signal. It catches the commonest failure of a generated security fix, which is a change that looks plausible and leaves the flagged data flow intact.

It says nothing about whether the application still works. Nothing in the changelog or docs says the agent runs your test suite as part of validation. A fix that sanitises an input by rejecting a value your callers legitimately send closes the alert and breaks a feature. Your own CI is what finds that, which is a reason to confirm the draft PR triggers your full workflow before anyone reads the summary.

It also says nothing about whether the fix is the right fix. A path traversal alert can close by validating at the sink, at the entry point, or by deleting the feature. All three turn the alert green.

What it explicitly can’t confirm

The documentation is direct here. Validation works on a best-effort basis, and Copilot re-runs CodeQL with the code scanning query suite. It can’t confirm fixes for alerts from custom CodeQL queries, the security-extended suite, or alerts from third-party tools.

The July preview announcement said agentic autofix works for CodeQL and third-party alerts. Both can be true: the agent can attempt a fix for a third-party finding, but the CodeQL re-run can’t verify it, because CodeQL never produced the finding. For those alerts the validation line in the PR is weaker than it reads, and GitHub says the pull request will state when it couldn’t validate a fix or suspects a false positive. Treat that statement as the first thing to look for in the description.

If your org runs the security-extended suite, which many do for stricter coverage, the same applies. The re-run uses a different, narrower suite than the one that raised the alert.

Triggering it from a script

Besides the Assign to Copilot button, the changelog lists a REST route: the Update a Code Scanning Alert endpoint, with the assignee set to copilot-swe-agent[bot]. The REST reference documents assignees as an array of strings on a PATCH to the alert, so the call looks like this:

curl -L -X PATCH \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/repos/OWNER/REPO/code-scanning/alerts/ALERT_NUMBER \
  -d '{"assignees":["copilot-swe-agent[bot]"]}'

The version header is taken from the sample in the reference. The call is shown as documented and needs the licence above. Fine-grained tokens need the “Code scanning alerts” repository permission with write access.

A script like this lets a nightly job assign only low-severity alerts in files with good test coverage and leave the rest for a person. That’s a sensible policy, and it’s opinion, not a documented workflow. The endpoint has no per-call way to cap spend, so cap it in the script and in the budgets mentioned below.

Reviewing the draft PR

A short checklist that fits what the docs promise and what they don’t:

1. Read the validation section first. If it says the fix couldn’t be validated, or flags a possible false positive, review as if no check ran.
2. Check the alert’s source. Custom query, security-extended or third-party means the CodeQL re-run proves little.
3. Confirm your own CI ran on the PR and passed. The agent’s summary isn’t a substitute for a failing test.
4. Look at where the fix lives. A change at the sink is usually narrower than one that rewrites callers.
5. Reject fixes that delete code to remove the alert, unless deleting it is actually what you want.

Copilot uses the custom instructions that apply to the repository when it generates a fix, so a few lines in the repo’s Copilot instructions about your validation libraries or banned patterns will shape the output. You can also comment on the pull request to ask for changes, or work in the Agents tab, per the changelog.

What it costs

Each agentic autofix session consumes AI Credits from the Code Security budget and GitHub Actions minutes, shown as the “Advanced Security” product in enterprise billing. SKU-level budgets are available. The older Copilot Autofix, a single suggested change on one alert, doesn’t consume AI credits, according to the docs, and remains available when agentic autofix isn’t enabled.

So the choice between them is practical: a small, local alert with an obvious one-line fix suits the suggestion. An alert that needs changes across several files, or a batch of related ones, is where the agent session earns its credits.

A companion that blocks nothing

GitHub shipped AI Scan for pull requests on the same day. It covers languages CodeQL doesn’t, such as PHP, Shell/Bash, Terraform and Dockerfiles. Its findings are advisory: they don’t fail the code scanning check and can’t block a merge through a ruleset. It also skips pull requests from forks and from Dependabot. If you were planning to gate merges on it, you can’t.

Try this week

Pick one real alert on a default branch, assign it to Copilot, and before reading the diff, note which query suite raised it. Then review the PR with the checklist above and see whether the validation line told you anything the diff didn’t.