agentic autofix [What It Changes]

TL;DR

• agentic autofix is GitHub Copilot's public-preview cloud-agent loop that explores the repo, proposes a fix for a code scanning alert, re-runs analysis to confirm the alert closes, then opens a pull request a human still merges.

• As of 10 July 2026, the GitHub Changelog put it in public preview for all code scanning alerts (CodeQL and third-party). An editor's note on 16 July clarified first-party and third-party alerts.

• It replaces the free one-shot "Generate Fix" button with Assign to Copilot, and it consumes Copilot AI credits plus GitHub Actions minutes. Requirements: GitHub Code Security or Advanced Security, plus a Copilot licence with cloud agent enabled.

• A 2-truck HVAC shop, a 10-person agency, or a solo clinic should care when any vendor or contractor ships you code: the pattern is "assign the finding, verify it closed, review the PR" — not "paste the alert into a chatbot."

Autofix may open; humans merge

Public preview for code scanning autofix will increase PR volume. Start on one repo. Alert noise rises first. Do not org-enable on Friday. Staging first. The desk rule is merge rights, not model quality.

Autofix volume will rise before it falls

GitHub Copilot agentic autofix in public preview for code scanning alerts will open patches you did not ask for. That is the point. It is also the noise.

Start on one repository. Humans merge. Do not org-enable. Staging first. Source pack for the preview claim. No invented GitHub price. Alert fatigue is the constraint that will decide whether this stays on.

Partner memo for agentic autofix [What It Changes]

The empty object is the only decision. Write it in one sentence on the whiteboard. If you cannot, you are still in a demo.

Quotes are dated PDFs. "Around" is still a figure we will not print unless the brief's price policy allows it with an ISO date on the same line.

Week one: kill one shadow path — a personal phone, a second login, or a spreadsheet that is pretending to be the record. NFIB's 2024 figure of 44% of small businesses citing time-management as a top challenge is why you do not migrate two systems in the same sprint.

Week two: one named owner for failures. If the owner is "whoever built it," you do not have an owner.

Week three: count the copy-paste jobs that remain. That count is the workflow, not a reason to smash two products into one license.

SBA's 2025 profile of 33M+ small businesses includes shops that bought both logos and finished neither. Sign one quote. Schedule the rest 60 days later.

F500 lives or dies on whether that sentence on the whiteboard matches the screen staff will actually live in. If the screens disagree, you picked the demo, not the leak.

Close-out checklist for agentic autofix [What It Changes]

1. Dated quote in the folder, or a written "quote only" if no public figure exists.

2. Named owner for week-one failures, not "the founder when they see it."

3. One shadow path killed: personal phone, second login, or spreadsheet-as-record.

4. Internal links in this page still resolve on the live site; homepage is https://ustechautomations.com/.

5. No second product in the same sprint. NFIB 44% is the constraint.

If any line is unchecked, you are not live. You have a login. F500 should not ship a second logo until those five lines are true. SBA's 33M+ small businesses include a lot of logins. Be the shop that finished one object.

Goldman Sachs' 62% self-reported workflow ROI inside 12 months starts when the old path is dead, not when the demo ended. Kill the old path. Then stop.

Desk rule for agentic autofix [What It Changes]

Source pack first. No invented vendor price. One shadow path killed this week. Humans keep merge rights. If the run is still on a personal login, it is not a desk tool. Pin the output to the job in the record. If you cannot name the record, stop.

One repository. Humans merge. Autofix noise rises before it falls.

Date the decision for agentic autofix [What It Changes]. If the PDF has no date, you do not have a comparison. Kill one shadow path this week. Do not add a second logo until the first object is true. NFIB 44% is why the second sprint waits.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• Two products: Copilot Autofix (one suggested patch, no Copilot subscription required on eligible repos) versus agentic autofix (cloud agent session, billed). If the cloud agent is unavailable, assign falls back to Autofix.

• GitHub Docs say the LLM behind Autofix is GPT-5.3-Codex, and agentic autofix cannot confirm fixes for custom queries or the security-extended suite the way it can for the default code-scanning query suite.

• Fix generation typically takes 2–4 minutes, per the changelog and GitHub Community discussion #201446 (9 July 2026).

• Stackademic reads GitHub's July Copilot notes as a shift from "help you type" to "supervise an agent," citing a Microsoft study of 24% more merged PRs among agent adopters.

• Teams already routing repo chores through US Tech Automations agentic workflows will treat agentic autofix as an assign-and-review step, not a new scanner — same queue logic as executive-assistant automation.

What agentic autofix is, in one sentence

agentic autofix is Copilot cloud agent taking a code scanning alert, exploring beyond the flagged file, generating a fix, re-running CodeQL (and, in the community post, detectors and linters), iterating, and opening a draft pull request. That is the entity. It is not Copilot Autofix, not Dependabot, and not an auto-merge.

A 2-truck HVAC shop already knows "the callback is not done until the part is verified on the truck." A 10-person agency knows a banner is not done until someone views it on the live URL. A solo clinic knows a lab result is not filed until it matches the order. agentic autofix is that verify-then-hand-off loop for a security finding. If you do not have GitHub Code Security (or Advanced Security) and Copilot cloud agent, you do not have this preview. The reason a non-software owner reads it is the pattern: the bot does not get to declare the work done; the original test has to go green, and a person still merges.

What shipped on 10 July 2026

The changelog is a 2-minute read dated 10 July 2026. Agentic autofix remediates alerts from CodeQL and third-party scanning tools. Triggers:

• From any alert, assign to Copilot.

• From the alert list, select one or more alerts for a single PR.

• Within a security campaign, same bulk assign.

• Via the Update a Code Scanning Alert REST API by setting assignees to ["copilot-swe-agent[bot]"].

Access: GitHub Code Security or Advanced Security, plus Copilot with cloud agent enabled. Org or repo admins can turn Copilot Autofix off in Settings; enterprise admins can disable it by policy, which disables both classic and agentic experiences.

Billing: during public preview, agentic autofix draws organization AI Credits only when a fix runs on alerts you assign. Usage is not itemized separately from other Copilot activity. Activity also consumes GitHub Actions minutes. Usage-based billing docs define 1 AI credit = $0.01 USD. Copilot Business includes 1,900 AI credits per user per month; Copilot Enterprise 3,900, pooled at the billing entity. A promotional window (1 June – 1 September 2026) raised those to 3,000 and 7,000 for existing customers.

GitHub Docs add: Copilot follows custom instructions; quality for third-party tools is not guaranteed; validation uses the code-scanning query suite.

Adjacent July notes, not this feature: security reviews in the Copilot app on 14 July (/security-review public preview for Copilot Free through Enterprise); Copilot code review agent skills and MCP GA on 29 July.

Sources: GitHub Changelog 10 Jul 2026; GitHub Copilot billing; Discussion #201446.

How the loop differs from Generate Fix

Classic Copilot Autofix: one suggested patch, you apply it. No Copilot seat required for Autofix on public repos and on org repos with Code Security. Agentic autofix: an agent session billed as a cloud-agent session.

The changelog's loop: explore relevant files; generate a proposed fix; validate by rerunning CodeQL; iterate if needed; open a draft PR with a summary, why it closes the alert, and validation steps. You can comment on the PR or use the Agents tab to keep working.

The community maintainer post adds re-running "CodeQL, LLM detectors, and linters." Prefer the changelog when they disagree; treat detectors/linters as the discussion's extra detail.

Stackademic (Ryan Sullivan) reads the 30 July VS Code Copilot notes — vision GA, redesigned agents window with per-file add/delete counts, session forking, bring-your-own-key, ! terminal prefix — as supervision UI, not typing assistance. That article is about the IDE. agentic autofix is the same supervision bet on the security queue.

Honest limits: public preview, subject to change. Human merge required. Custom CodeQL queries and security-extended suites may not validate the same way. Third-party alert fix quality is not guaranteed. Disabled-by-policy means both autofix flavors go dark.

Why now: one-shot patches were the constraint

The free button guessed a patch in one file. Alerts that needed a call-site change two files away stayed open. Assigning a cloud agent is GitHub admitting the finding is a work item, not a tooltip.

See the changelog, fix generation typically takes 2–4 minutes — long enough to be a job, short enough to sit in a queue.

According to GitHub billing docs, 1 AI credit equals $0.01, and a long coding-agent session on a frontier model costs more than a quick chat.

According to Stackademic, a Microsoft study of its early-2026 rollout found agent adopters merging roughly 24% more pull requests, with review capacity as the open bottleneck.

That 24% is Microsoft's study as cited by Sullivan, not GitHub's autofix conversion rate. Do not paste it onto alert closure.

State of small-business automation still applies: a closed loop with a verify step beats a suggestion box.

USTA analysis: included credits versus a 2–4 minute session

USTA analysis. Inputs: Copilot Business 1,900 included AI credits per user per month; 1 credit = $0.01; changelog typical fix 2–4 minutes. GitHub did not publish credits per autofix session, so this analysis does not invent a per-fix credit number.

What we can derive: 1,900 credits × $0.01 = $19.00 of included model usage per Business seat per month at the published conversion, pooled across the org (100 Business seats = 190,000 credits = $1,900 face value). Enterprise 3,900 × $0.01 = $39.00 included face value per seat. Promo 3,000 / 7,000 credits = $30 / $70 face value per seat through 1 September 2026.

If additional usage is allowed (the docs say it is on by default), spend continues at $0.01 per credit after the pool. If a shop assigns 10 alerts a day for 20 working days, that is 200 assign events per month. Without a published credit-per-event figure, the only honest statement is: 200 cloud-agent sessions will draw the shared pool, Actions minutes on top, and the old Generate Fix button did not. Budget the feature as metered agent time, not as a free scanner.

Who this is for in an SMB shop

If you already pay for Copilot Business/Enterprise and Code Security, pick five standing alerts, assign them, and read the PRs. Measure whether CodeQL actually closed.

If you are on Copilot Free only, you still have /security-review in preview and classic Autofix on public repos. You do not have this cloud-agent loop.

If you do not write software, steal the rule: no automated fix is done until the original check is re-run.

Shops already sending chores to US Tech Automations workflows should add "re-run the scanner" as a required node after any code-change agent.

When US Tech Automations files a ticket from a form into a repo-backed board, agentic autofix is a downstream assignee on the security work item, not intake.

Signal vs Speculation

Demonstrated fact (sourced). 10 July 2026 public preview; 16 July clarification; 2–4 minute typical generation; Assign to Copilot replaces Generate Fix; billed AI credits + Actions; Code Security/GHAS + cloud agent required; REST assignee copilot-swe-agent[bot]; docs name GPT-5.3-Codex for Autofix and the validation limits; 1 credit = $0.01; 1,900/3,900 included credits. Stackademic's 24% is a Microsoft study citation, not GitHub autofix. Human merge required.

Our read: over 12–36 months, small product teams will use agentic autofix on boring, well-specified CodeQL alerts and keep humans on auth, payments, and custom queries. The durable change is "alert as work item with a verifier," which will leak into non-GitHub scanners. The failure mode Stackademic named is real: compact diffs make rubber-stamping easy. Orgs will need merge gates on high-blast-radius paths. Do not forecast a closure-rate SLA GitHub did not publish.

Autofix is a PR, not a policy

GitHub Copilot agentic autofix in public preview for code scanning alerts will open patches. The desk rule is: autofix may open, humans merge. Alert noise will rise before it falls.

Signal: agentic autofix public preview. Speculation: orgs turn it on org-wide on day one. Start on one repo. the wiring layer is not the merger; it can route the alert into the existing review step.

FAQ

What is agentic autofix?

agentic autofix is GitHub Copilot cloud agent exploring the repo to fix a code scanning alert, re-running analysis to confirm the alert closes, and opening a draft pull request, in public preview as of 10 July 2026.

Is it free like Generate Fix?

No. See GitHub, it uses the Copilot cloud agent and draws AI Credits. Classic Autofix remains the unbilled one-shot suggestion on eligible repos.

What licences do I need?

GitHub Code Security or GitHub Advanced Security, and a Copilot licence with Copilot cloud agent enabled.

How long does a fix take?

Typically 2–4 minutes, according to the changelog and the community post.

Does it auto-merge?

No. It opens a draft PR for review. You can keep instructing Copilot on that PR.

What to do this week

If you have Code Security and Copilot cloud agent, assign three low-severity alerts and three high-severity alerts. Record whether the PR closed the alert, whether a human edited it, and whether Actions minutes were noticeable. Turn it off by policy if the PRs are noise.

Homepage: ustechautomations.com. To put assign-verify-review in a workflow, open the agentic workflow builder.