GitHub's agentic autofix hits GA: batch 25 alerts into one draft PR
Both of GitHub's AI security tools leave preview at once: autofix validates each fix with CodeQL before the PR, AI Scan reads Terraform and Dockerfiles.
Copy markdown
Autofix: 25 alerts, one validated draft PR
Select up to 25 code-scanning alerts and Copilot explores the repo, writes a fix, reruns CodeQL to confirm it actually closes each alert, then opens a single draft PR with its reasoning and validation steps. You review and comment instead of hand-patching. Needs Code Security or GHAS plus an admin-enabled "Agentic autofix" policy; it draws Code Security AI Credits and Actions minutes, and only works on the default branch.
AI Scan reaches the files CodeQL skips
AI Scan for pull requests is now GA and covers what CodeQL never parsed: PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP and Blazor. It runs automatically on PRs, flags risks with an "AI" marker and a suggested fix, and is advisory-only so it won't block merges. Free on public repos with no Copilot license required.
The new line on your bill: Code Security AI Credits
Both tools spend from Code Security AI Credits, shown as "Advanced Security" in enterprise AI-usage billing, and you can cap them with SKU-level budgets. If you flip these on org-wide, set a budget first so an agent fixing 25 alerts at a time doesn't surprise you.
OpenAI lets GPT-Live act mid-sentence
GPT-Live can now call the Decisions API natively while the user is still talking, firing typed decisions off input/output transcript deltas instead of waiting for a full turn. That means voice agents that react before the caller finishes. GPT-Live runs at $0.05/min billed per second; Decisions (on gpt-6-luna) is billed separately.