AI-Powered Fixes Close the Gap Between Detection and Remediation
Security scanning has long been able to tell developers where a vulnerability lives, but it has stopped short of telling them how to fix it. That leaves remediation in the hands of developers who may lack deep security expertise or familiarity with the code in question—especially when the vulnerable code was written months or years earlier. GitHub is trying to close that gap with Copilot Autofix, which is now generally available in GitHub Advanced Security (GHAS).
Copilot Autofix analyzes code vulnerabilities, explains why they matter, and generates concrete fix suggestions. During the public beta, developers using the tool fixed code vulnerabilities more than three times faster than those remediating manually. The tool is designed to prevent new vulnerabilities from reaching production and to help teams chip away at existing security debt.
Faster Fixes at Pull Request Time
Since the public beta began in March 2024, developers have used Copilot Autofix directly in pull requests to address vulnerabilities in new code before merge. The tool covers dozens of vulnerability classes, including SQL injection and cross-site scripting, and produces suggestions that developers can edit, dismiss, or commit to the pull request.
Customer data from May through July 2024 shows the time savings are substantial:
- 3x faster overall: median time from detection to a committed fix was 28 minutes with Copilot Autofix, versus 1.5 hours for manual remediation.
- 7x faster for cross-site scripting: 22 minutes versus nearly three hours.
- 12x faster for SQL injection: 18 minutes versus 3.7 hours.
Reducing the Cost of Security Debt
Old vulnerabilities that have sat dormant are often the hardest to remediate. A developer asked to fix code they haven't touched in months must first reconstruct the surrounding context, then experiment with manual patches. Copilot Autofix is meant to compress that process: a developer selects Generate fix on an existing GHAS code scanning alert, and the tool returns an explanation along with a code suggestion. Pressing Create PR with fix opens a new pull request containing the proposed changes.
Copilot Autofix takes care of cumbersome security tasks, ensuring our existing and new code is always as secure as possible. Vulnerabilities are flagged immediately and code changes are recommended automatically. It helps our teams to free up time so they can focus on more strategic initiatives.
This workflow makes it practical to address lower-severity issues that often go deprioritized, allowing teams to reduce backlogs of security debt without dedicating scarce security expertise to every triage decision.
Under the Hood
Copilot Autofix combines the CodeQL analysis engine with GPT-4o and a set of heuristics and GitHub Copilot APIs. The LLM prompt is built from CodeQL analysis output and short code snippets around the data flow path, which keeps the suggestions contextualized to the actual vulnerable code.
Support for Open Source Maintainers
Open source projects face the same remediation burden, with the added risk that a single unpatched dependency can cascade across downstream consumers. GitHub already offers maintainers free access to code scanning, secret scanning, dependency management, and private vulnerability reporting. Starting in September, Copilot Autofix in pull requests joins that list at no cost for all open source projects.
What's Next
GitHub frames Copilot Autofix as part of a broader push to embed AI assistance across GHAS. Secret scanning already uses AI to detect generic passwords, and new workflows are being developed to scale Copilot Autofix for organizations with large volumes of security debt. For existing GHAS customers on GitHub Enterprise Cloud, the feature is enabled by default.
The vision is straightforward: a vulnerability found should mean a vulnerability fixed—with the expertise, speed, and confidence that developers need to keep pace with the security demands of modern software delivery.
