GitHub Copilot: Agentic Autofix Now Uses Copilot Memory
GitHub CopilotGitHub Copilot's agentic autofix for code scanning alerts now draws on Copilot Memory for customers who have it enabled, reviewing previously stored memories for context before attempting to resolve a new security alert. When autofix successfully fixes an issue, it saves the fix pattern as a new memory, building a repository-specific record of secure coding patterns that can resolve future alerts faster and inform other Copilot features, like Copilot code review and the Copilot cloud agent, about how the codebase handles security. Both agentic autofix and Copilot Memory remain in public preview.
Key Takeaways
- GitHub Copilot's agentic autofix now checks a repository's existing Copilot Memory entries for context before attempting to resolve a new security alert.
- Every alert autofix successfully resolves gets saved back as a new memory, building a growing, repository-specific record of secure coding patterns.
- The shared memory record also benefits Copilot code review and the Copilot cloud agent, not just autofix itself.
- Agentic autofix already differentiates itself from traditional autofix by exploring the codebase and validating its own fix before proposing it, typically in two to four minutes.
- The integration requires an organization to have Copilot Memory enabled; no separate configuration is needed beyond that.
- Both agentic autofix and Copilot Memory remain in public preview, so behavior may still change before general availability.
Sources & Mentions
1 external resource covering this update
Memory Meets Security Remediation
GitHub Copilot's agentic autofix already stood apart from traditional autofix by exploring a codebase, validating its own proposed patch, and iterating until it was confident a fix was correct, typically finishing in two to four minutes rather than offering a single unverified suggestion. GitHub has now connected that workflow to Copilot Memory, its feature for building a repository-specific understanding that improves over time, for customers who have Memory turned on.
How the Feedback Loop Works
When agentic autofix goes to work on a code scanning alert, it now first checks existing memories tied to the repository for relevant context, information that might explain why a particular pattern is unsafe in this specific codebase or how similar issues were resolved before. Once autofix successfully resolves an alert, it writes the fix pattern back as a new memory rather than letting that knowledge disappear once the pull request merges. Over time, this creates a growing, repository-specific record of secure development patterns that autofix can draw on to resolve additional alerts faster and with more context than a fresh model invocation would have on its own.
The benefit is not limited to autofix itself. Because memories are shared infrastructure across Copilot's security and coding features, the same secure-pattern knowledge autofix builds up can also inform Copilot code review when it flags similar issues in a pull request, and the Copilot cloud agent when it works on code in the same repository, giving a codebase's accumulated security lessons a longer reach than any single feature working in isolation.
Availability
Both agentic autofix and Copilot Memory are available in public preview, and this integration between them requires a customer to have Copilot Memory enabled for their organization or repository. No additional configuration is needed beyond that to start building the shared memory record.