Agentic Copilot Autofix for code and dependency alerts in Azure DevOps
Copilot Autofix for GitHub Advanced Security in Azure DevOps now runs on an agentic foundation. It proposes fixes as pull requests for code scanning alerts from third-party tools and for dependency vulnerabilities. Your team still makes the final merge decision, so the fixes need to be reviewed like any other change.
Key points
- Request a pull request with an explanation from a dependency vulnerability alert using Generate fix.
- Alerts from third-party code scanning tools can now be sent to Autofix, not only CodeQL alerts.
- Custom instructions and skills are read from supported .github or .agents locations.
- EPSS percentile ranks predicted exploitation likelihood relative to others; it is not an attack probability.
- Combining the Runtime scope filter with a high EPSS range gives a practical starting point for triage.
- Review the full diff and run your build and tests before merging any generated fix.
Copilot Autofix for GitHub Advanced Security in Azure DevOps now runs on an agentic foundation built on the Copilot coding agent. It explores the relevant repository context, refines its proposed change, and returns it as a pull request inside your existing workflow. Custom instructions and skills placed in .github or .agents folders can steer fixes toward your approved helpers or your package-update procedure.
Autofix now covers code scanning alerts from third-party tools, not only a scoped set of CodeQL rules, and it can generate fixes for dependency vulnerability alerts. For triage, EPSS percentiles and development dependency detection help you decide which alerts to address first. Fixes consume AI credits and still need review, build and test runs before merging. The public preview is planned for November.
Real-world use
- Fixing input validation findings in an ASP.NET Core API that must use a shared, approved validation helper.
- Preparing an update for a runtime NuGet package with a high EPSS percentile, following the team's package-update procedure.
- Working through findings from a third-party SAST tool inside the Azure DevOps pull request flow.
Why it matters
A security alert can now start as a draft pull request, but your team's rules and test process still decide what gets merged. Triaging with EPSS and dependency scope keeps the review workload focused on the alerts that matter most.