Microsoft added agentic Autofix to GitHub Advanced Security for Azure DevOps. It now generates fixes for dependency vulnerabilities. It also works with third-party code scanning alerts. The agent uses repository context and custom instructions to refine changes. Teams review and approve fixes before merging. EPSS and development dependency detection help prioritize alerts. Autofix rolls out over the next two to three weeks. Public preview starts in November. Fixes consume AI credits and are not automatic. Not every request produces a usable fix.
What changed
Autofix was limited to CodeQL rules and did not support dependency fixes.
What it unlocks
Generating pull requests for dependency and third-party code scanning alerts.
- 2-3 weeks rollout period
- public preview in November
What you need to act on it
- GitHub Advanced Security for Azure DevOps
- supported alert type
- AI credits available
Sources