Research note
Research note: GitHub makes AI Scan and Agentic Autofix generally available, using AI to find and fix security flaws in code
How we checked what GitHub’s AI Scan and Agentic Autofix do, who can use them and how they are billed.
What we set out to check
What each feature does, its limits, which plans include it, and how it is billed.
What we found
- Both features are described in separate GitHub changelog posts dated 15 October.
- AI Scan works without a Copilot licence; Agentic Autofix needs a Copilot billing method.
- Neither post gives a price per AI credit.
Numbers that differ
None.
Labels we chose and why
- Confirmed for all facts, from GitHub’s own posts.
What we could not verify
- How accurate AI Scan is; GitHub gives no false-positive rate.
- The cost per credit.
- Which programming languages Agentic Autofix supports; its post does not list them.
We did not test either feature ourselves.
What we searched
- GitHub AI Scan pull requests generally available
- GitHub agentic autofix code scanning GA
- GitHub Code Security AI credits
Every source we read
| Source | Used? | Why |
|---|---|---|
| GitHub Changelog: AI Scan | USED | Scope, languages, limits, plans and billing. |
| GitHub Changelog: Agentic Autofix | USED | How it works, limits, plans and set-up. |
| AI Weekly | NOT USED | Short summary. |