Introducing Agentic Autofix for code and dependencies

Fixing a vulnerability takes more than knowing where it is. You need a change that follows your coding standards and works with the rest of your code.

Copilot Autofix for GitHub Advanced Security for Azure DevOps now runs on an agentic foundation. It also supports dependency vulnerability fixes and code scanning alerts from third-party tools.

Select the alert to address, Autofix works in the background on a proposed change in your existing Azure DevOps workflow, and your team keeps the final decision on what to merge.

Agentic fixes use your repository context

Your team might require a shared validation helper or a specific package-update procedure. A fix that ignores those decisions still leaves you with work to do.

Agentic Autofix uses the Copilot coding agent to explore relevant repository context. It can review and refine its proposed changes before returning a suggestion.

It can also use custom instructions and skills in supported .github or .agents locations. For example, instructions can direct the agent to use your approved input-validation helper. A dependency-update skill can describe your package-update procedure and compatibility checks.

This gives the agent guidance about how changes should fit your repository. Instructions and skills provide additional context to guide Autofix in the right direction and minimize bespoke remediation.

The same workflow, beyond CodeQL

Previously, Autofix was limited to fix generation for a scoped set of CodeQL rules. Now, if you use another code scanning tool, you can now request Autofix for those alerts too.

Generate fixes for dependency vulnerabilities

Dependency scanning identifies vulnerable packages and provides remediation guidance. You still have to turn that guidance into a change. Autofix now gives you a fix-generation workflow for these findings, not just static analysis results.

Open a supported dependency vulnerability alert and select Generate fix. Then, Agentic Autofix can open a pull request with a suggested change and an explanation. You review it through the same process you use for other code changes.

Decide which dependency alerts to address first

Severity alone doesn’t tell you how likely exploitation is or how your project uses a vulnerable dependency. EPSS and development dependency detection add that context to dependency triage.

The Exploit Prediction Scoring System (EPSS) estimates exploitation likelihood in the wild. When data is available, Advanced Security shows the EPSS percentile for a dependency alert. A higher percentile means a higher relative rank for predicted exploitation likelihood. It isn’t the probability that someone will attack your application.

Alongside EPSS, development dependency detection distinguishes development-only dependencies from runtime dependencies in supported ecosystems. Use the Development badge and Scope filter to understand the dependency’s role.

For example, for prioritization, combine the Runtime scope filter with a high EPSS percentile range to focus a triage pass. Then, consider severity and your application’s exposure before choosing a supported alert for Autofix.

Get started

From the organization, project, or repository-level, enable agentic Autofix with a single button for both dependency and code scanning alerts. From there, select individual alerts at the repository-level that you want to receive Autofixes for.

Agentic Autofix will roll out over the next two to three weeks. If your organization is enrolled in the limited public preview, request a fix from a supported dependency or code scanning alert. Review the full diff, run your build and tests, and verify the code changes before merging.

Generating fixes consumes AI credits; enabling Autofix doesn’t generate fixes automatically. Not every request produces a fix, and AI-generated suggestions should be reviewed for correctness.

Agentic Autofix will be available in public preview in November.

For details, see Prioritize dependency scanning alerts and Copilot Autofix for code security alerts.

Share feedback here, via email, or through the Azure DevOps Developer Community.