Agentic autofix explores the codebase, validates a fix with CodeQL and opens a draft PR. AI Scan covers languages CodeQL does not, with advisory findings only.
GitHub on Thursday took two AI security features to general availability. Agentic autofix for code scanning alerts, aimed at GitHub Code Security and Advanced Security customers on Enterprise Cloud, assigns an alert to Copilot so it can explore relevant files, propose a fix, rerun CodeQL to confirm the alert is closed, and open a draft pull request for review. AI Scan for pull requests is also generally available: it looks for vulnerabilities in PR changes for languages and frameworks CodeQL does not currently cover, including PHP, Shell/Bash, Terraform HCL, Dockerfiles and others. AI Scan findings are advisory, do not fail the code scanning check and cannot block merges through rulesets. Both features consume Code Security AI Credits per GitHub’s billing notes.
Sources: GitHub Changelog: agentic autofix · GitHub Changelog: AI Scan · GitHub Docs