Tools #Coding agents Oct 16, 2026 · Originally published Oct 15

Code scanning alerts can be assigned to Copilot, which reruns CodeQL to verify and opens a draft PR, up to 25 alerts at a time

Fixing security alerts moves from generating a patch to an agent that edits, verifies and hands over a PR.

Primary source GitHub Changelog · github.blog Read the original ↗

// Key points

The agent explores relevant files, proposes a fix, reruns CodeQL to confirm the alert is closed and opens a draft PR with a summary, why the fix works and validation steps; you can ask Copilot for more changes in PR comments or the Agents tab.
You can assign any alert on the default branch to Copilot (replacing the free Generate Fix button), select up to 25 alerts to fix in one PR, or set assignees to copilot-swe-agent[bot] via the REST API.
It is for GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including data residency; an enterprise admin must enable the policy and a Copilot billing method must be set.
It uses AI Credits from the Code Security budget plus GitHub Actions minutes; alerts found only on PRs or non-default branches can’t be assigned.

Builder's takeRerunning the scan to prove the alert is closed is the part I value most: it gives agent fixes a verifiable definition of done for the first time. But it replaces the free Generate Fix and bills AI Credits plus Actions minutes, so I’d batch-assign a set of low-risk old alerts first, check PR acceptance and cost per alert, and then decide whether new alerts go to it by default.

// Background · from #Coding agents

Full timeline →