GitHub’s Security Autofix Agent Now Remembers What It Fixed

GitHub's Security Autofix Agent now remembers the fixes it has previously applied, thanks to Copilot Memory integration. Since September 25, when the company announced this enhancement, the agentic autofix agent checks its stored memories for context before addressing a security issue. After generating a fix, it saves the pattern for future reference.

These memory patterns aren't confined to the autofix agent; they help other Copilot features like code review and the cloud agent learn secure development practices specific to the repository. Both agentic autofix and Copilot Memory are currently in public preview. The autofix agent, which entered public preview on July 10, works by assigning a code scanning alert to Copilot, which then explores relevant files, proposes a fix, and confirms the alert is resolved through CodeQL.

If unsuccessful, it attempts to fix the issue again before opening a draft pull request explaining the fix. The requirement for a GitHub Code Security or Advanced Security license, along with a Copilot license with the cloud agent enabled, applies. The organization's AI credits and GitHub Actions minutes are also used. Copilot Memory stores repository facts like coding conventions and build commands, as well as user preferences, with validated facts staying in the repository for future use.

Unused facts are deleted after 28 days. The real value lies in how this fix pattern can inform code review, catching security issues early before they merge. This development signifies a shift in trust for agentic tooling, as GitHub demonstrates how it earns trust by showing its work. However, teams should treat this as a preview, checking details such as when the fix pattern is saved, who turns on Memory, the associated costs, and the duration of lessons stored in memory.