GitHub Ships Agentic Autofix and AI Scan for PRs to General Availability

GitHub said on 15 October 2026 that agentic autofix for code scanning alerts is generally available, and in a companion changelog that code scanning AI Scan for pull requests is generally available too. They are same-day Code Security features, not a single product rename.

Agentic autofix — what GA includes

Agentic autofix, GitHub says, remediates code scanning alerts by exploring relevant files, proposing a fix, rerunning CodeQL to confirm the alert closes, then opening a draft pull request for review. It is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including Enterprise Cloud with data residency.

When enabled, it replaces the free “Generate Fix” control on alerts with Assign to Copilot. You can:

• assign a default-branch code scanning alert to Copilot
• select up to 25 alerts to fix together in one PR
• call the Update a Code Scanning Alert REST API with assignees: ["copilot-swe-agent[bot]"]

GitHub is explicit that only alerts on the repository’s default branch can be assigned; alerts found only on PRs or other branches cannot.

Access and billing for autofix

An enterprise admin must enable the “Agentic autofix” Advanced Security policy. Then an org or repo admin turns the feature on in Code Security settings. Access also requires a Copilot billing method. Usage consumes Code Security AI Credits and GitHub Actions minutes.

AI Scan for pull requests — advisory by design

AI Scan complements CodeQL by looking for vulnerabilities in PR changes for languages and frameworks CodeQL does not currently cover, including PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more. Findings can include a risk explanation and a suggested autofix, shown with an “AI” indicator beside CodeQL results.

Findings are advisory. GitHub states they do not fail the code scanning check and cannot block pull request merges through ruleset requirements. AI Scan does not run on fork PRs or Dependabot PRs.

Access and billing for AI Scan

AI Scan is available for public repositories. Private and internal org repos need Code Security or Advanced Security. A GitHub Copilot licence is not required. It consumes Code Security AI Credits.

After the draft PR lands

GitHub says the autofix pull request includes a summary of the fix, why it closes the alert, and the validation steps Copilot took. When that PR is ready, developers can ask Copilot for further changes by commenting on the pull request or using the repository Agents tab session. That keeps a human in the merge path even though the agent explored the codebase and re-ran CodeQL.

AI Credit usage for both features shows under the “AI usage” section of enterprise billing as the “Advanced Security” product, and admins can set SKU-level budgets for Code Security AI credits. That billing detail matters for security teams who already cap Actions minutes and do not want unbounded agent remediation loops.

Why the distinction matters

Autofix is an agent loop that tries to close a CodeQL alert and prove it with a re-scan before humans review a draft PR. AI Scan widens language coverage on PRs but stays out of the merge gate. Teams that treat every security check as blocking CI should not assume AI Scan behaves like CodeQL required status checks — GitHub says it cannot.

Context from earlier TSN coverage

Automated review and coding agents are crowding the same PR surface. TSN covered Anthropic’s Claude Code Review going GA, Gemini 4 Argon in GitHub Copilot, and Cline cloud sessions. GitHub’s pair of GA features is the platform’s own Code Security answer: agentic remediation for CodeQL, plus advisory AI scanning where CodeQL does not reach.

What’s still unknown

• Typical AI Credit burn for multi-alert autofix batches
• False-positive rates for AI Scan across the newly covered languages
• How often CodeQL revalidation rejects an autofix proposal in practice

What to watch

Watch enterprise policy defaults and whether GitHub later offers an optional blocking mode for AI Scan (it does not today).

What this means

• Agentic autofix is GA for Code Security / Advanced Security on Enterprise Cloud, with CodeQL revalidation and draft PRs.
• AI Scan for PRs is GA and advisory — it cannot block merges.
• Autofix needs the enterprise policy and a Copilot billing method; AI Scan does not need a Copilot licence.

Sources

1. GitHub Changelog, “Agentic autofix for code scanning alerts general availability”, 15 October 2026
2. GitHub Changelog, “AI Scan for pull requests generally available”, 15 October 2026

Related stories

• Anthropic Makes Claude Code Review Generally Available for Team and Enterprise
• Gemini 4 Argon Is Now Generally Available in GitHub Copilot
• Cline v4.1.25 Adds Cloud Sessions That Keep Running After You Close the Editor