GitHub moved two security features to general availability on 15 October.
Agentic Autofix explores the code, proposes a fix, validates it with CodeQL and opens a draft pull request. You can assign a single alert to Copilot, or fix up to 25 alerts in one PR through the REST API. It is available to Enterprise Cloud customers with Code Security or Advanced Security, and consumes AI Credits and Actions minutes.
The CodeQL validation step is what separates this from an LLM guessing at a patch. The agent's fix has to pass the same static analysis that raised the alert before a human sees it, which means a proposed fix that does not actually close the vulnerability never reaches review. AI Scan covers the other gap: vulnerability scanning for languages CodeQL never supported - PHP, Shell, Terraform, Dockerfiles, JSP and Blazor. Free for public repositories; private and internal repos need Code Security or Advanced Security, billed through AI Credits.
Terraform and Dockerfiles are the quiet win there. Infrastructure-as-code has carried real security weight for years with far less automated scrutiny than application code, largely because the analysis tooling did not exist.