# GitHub Copilot Agentic Autofix: Verified Fixes, Auto PR > Source: > Published: 2026-07-15 07:11:54+00:00 GitHub shipped agentic autofix in public preview on July 14, 2026, and it is not a minor update to Copilot Autofix. The old version suggests a patch and waits for you to apply it. The new one assigns a Copilot cloud agent to your security alert, explores your codebase, generates a fix, reruns CodeQL to verify the fix actually closes the vulnerability, iterates if it doesn’t, and opens a draft pull request for your review. The human touchpoint is now at the end, not the beginning. ## What Changed: One-Step Suggestion vs. a Full Agent Loop Copilot Autofix has been around since March 2024. It works by sending CodeQL’s SARIF alert data, surrounding code snippets, and the query’s help text to a language model, which produces a suggested patch displayed inline in your pull request. You look at it, decide if it’s reasonable, and apply it. It remediates roughly two-thirds of vulnerabilities with little or no editing. That’s legitimately useful. Agentic autofix uses the same CodeQL foundation but runs a full [agent session](https://github.blog/news-insights/product-news/found-means-fixed-introducing-code-scanning-autofix-powered-by-github-copilot-and-codeql/) instead of a one-shot suggestion. The loop is: - Copilot cloud agent explores relevant files across your entire codebase — not just the lines around the alert - It generates a proposed fix - It reruns CodeQL to confirm the fix actually closes the alert - If CodeQL still flags the issue, it iterates and tries again - Once verified, it opens a draft pull request with a summary of the fix and the validation steps it took The self-verification step is the real news. The original Autofix could produce a fix that looked right but didn’t neutralize the vulnerability. Agentic autofix cannot ship a PR without passing CodeQL first. Fix generation takes 2–4 minutes on average. ## Three Ways to Trigger Agentic Autofix GitHub gives you four entry points into the workflow: **Single alert:** On any[code scanning alert](https://docs.github.com/en/code-security/concepts/code-scanning/copilot-autofix-for-code-scanning)page, use the “Assign to Copilot” button. One agent session, one draft PR.**Batch (up to 25 alerts):** Select multiple alerts from the security alerts list and assign them together. Copilot consolidates fixes into a single pull request, keeping your diff reviewable.**Security campaign:** For org-wide remediation pushes,[assign alerts inside a security campaign](https://docs.github.com/en/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/fixing-alerts-in-security-campaign). This is the path for teams closing hundreds of open alerts before an audit.**REST API:** Set`assignees` to`["copilot-swe-agent[bot]"]` on the Update Code Scanning Alert endpoint to trigger it programmatically from your own tooling. ``` PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number} { "assignees": ["copilot-swe-agent[bot]"] } ``` ## What GitHub Copilot Agentic Autofix Costs Each agentic autofix session draws from your organization’s AI Credits pool. One AI Credit equals $0.01 USD. Cost per session varies with the size of the surrounding code context and how complex the fix turns out to be. Copilot Enterprise users get 3,900 credits per user per month (temporarily bumped to 7,000 through September 1, 2026 for existing customers). Agentic autofix also consumes GitHub Actions minutes, since it runs inside the Actions environment. Two things admins need to do before enabling this: turn on “GitHub AI Credits paid usage” to allow overages, and set up hard-stop budgets on cost centers so a security campaign that assigns 100 alerts doesn’t quietly drain the month’s allowance. GitHub now allows [per-user AI credit budgets on cost centers](https://github.blog/changelog/2026-06-30-per-user-ai-credit-budgets-available-for-cost-centers/) — use them. ## Coverage: Languages and Vulnerability Classes Agentic autofix targets the vulnerability classes that dominate most security audits: SQL injection, cross-site scripting, path traversal, weak cryptography, and insecure data handling. Coverage spans 90% of alert types in JavaScript, TypeScript, Java, and Python. The success rate — remediating vulnerabilities with little or no additional developer editing — holds at roughly two-thirds. If your stack is primarily Go, Rust, or C++, coverage is narrower. CodeQL supports those languages, but autofix training data is strongest in the four core languages listed above. ## Requirements to Enable It Agentic autofix is not available on a base Copilot Pro subscription. You need: - GitHub Code Security or GitHub Advanced Security license - A Copilot license with Copilot cloud agent enabled During public preview, the feature is available to all plan tiers that meet those requirements. No geographic restrictions have been announced. ## This Is the Right Direction — Review Those PRs Carefully The “found means fixed” framing GitHub has been building toward finally has a credible implementation. A CodeQL alert that automatically becomes a verified, review-ready PR is a genuine improvement to the security workflow — the bottleneck has always been the gap between “we know about this vulnerability” and “someone got around to fixing it.” The caveat is worth stating plainly: review Copilot’s PRs carefully. [Researchers this month demonstrated](https://www.theregister.com/security/2026/07/07/github-ai-agent-leaks-private-repos-when-asked-nicely/) that GitHub’s agentic workflows can be manipulated via prompt injection to leak private repository contents. An automated system that explores your codebase and opens PRs is a meaningful new attack surface. The architecture is right; the trust model needs to keep pace with it. For teams already running GitHub Advanced Security, enabling agentic autofix and assigning a batch of high-severity alerts is a sensible immediate next step. Just set your AI Credit budget first.