What Agentic Autofix actually does
When assigned one or more code-scanning alerts, Copilot examines relevant repository files, generates a change, attempts validation, and opens a draft pull request with a summary of its work. This differs from Copilot Autofix, which offers one suggested change for a supported alert that you apply and review yourself.
Agentic Autofix is best effort. GitHub tells maintainers to review and test its changes before merging. A draft PR is the right starting point: it lets the team inspect a concrete diff without treating the bot as the final approver.
Understand the CodeQL validation limit
GitHub describes validation as rerunning CodeQL with the code-scanning query suite and checking whether the alert closes. That is useful evidence about this query and configuration. It does not, by itself, show that every attack path was fixed, that valid inputs still work, or that the patch introduced no regression.
GitHub also says this validation cannot confirm fixes for custom CodeQL queries, the security-extended suite, or alerts from third-party tools. If the PR reports that validation was unavailable, do not turn that into a silent pass.
Choose a bounded first pilot
Start with one understood alert on the default branch, in a repository whose owners have agreed to a small reversible change. Record the alert ID, query, branch, initial commit, and security invariant before assigning the work. That gives reviewers a baseline independent of the bot’s explanation.
Check feature availability and cost in your own GitHub account. GitHub documents different access rules for public and organisation-owned repositories; a session consumes Code Security AI Credits and GitHub Actions minutes. A Copilot licence is not itself required for Agentic Autofix, but the repository and organisation settings still matter.
- Confirm the feature is enabled for the repository and set a budget for credits and Actions minutes.
- Pick a single alert with a clear owner and a testable expected outcome.
- Avoid a first trial in authentication, payments, or personal-data flows.
- Read repository instructions that the agent may follow during its run.
Review the draft PR as a security change
- Read the agent session log and every changed file, including tests and configuration.
- Flag dependencies, removed checks, new exceptions, and edits outside the affected area.
- Run the repository’s build and test suite on the PR commit.
- Run a safe regression test for the original issue and a positive case for authorised behaviour.
- Confirm which CodeQL configurations reran and whether the original alert actually closed.
- Ask an independent human reviewer to record remaining risks and a rollback path before merge.
Alert ID and query: <VALUES>
Starting branch and commit: <VALUES>
Security invariant: <WHAT MUST BE BLOCKED OR ALLOWED>
Legitimate behaviour to preserve: <POSITIVE CASE>
Expected diff: <FILES OR AREA>
Actual diff: <CHANGED FILES>
Out-of-scope edits: <NONE OR LIST>
CodeQL rerun: <PASS / FAIL / NOT APPLICABLE>
Regression test: <COMMAND AND RESULT>
Repository tests: <COMMANDS AND RESULTS>
Independent review: <APPROVE / REVISE / HOLD>
Residual risk: <LIST>
Rollback: <PROCEDURE>Treat 25 alerts as a limit, not a target
GitHub permits up to 25 alerts in one Agentic Autofix assignment, session, and PR. A batch makes sense only when the alerts share a root cause, owner, test strategy, and rollback. Otherwise a single diff becomes harder to review and a green result becomes harder to attribute.
Measure accepted fixes, test failures, out-of-scope changes, review time, credits, and Actions minutes during a small pilot. Alert count alone is a poor measure of whether the workflow helped.
Primary sources and what was verified
The general-availability date and workflow come from the GitHub changelog. The differences between Autofix modes, validation limits, cost, access controls, and human-review requirement come from GitHub Docs. These sources were checked on October 19, 2026; product behaviour and billing can change.
No Agentic Autofix session was run for this article, so this guide does not claim a measured fix rate, run time, or cost.