GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws

GitHub announced a public beta of "code scanning autofix" for Advanced Security customers, using CodeQL, Copilot APIs, and GPT-4 to generate suggested fixes for over 90% of alert types in JavaScript, TypeScript, Java, and Python and plans broader language support. While the feature can propose multi-file changes and dependency updates to remediate vulnerabilities, GitHub warns developers to carefully review suggestions because they may be incorrect, change program semantics, fail to fix root causes, introduce new vulnerabilities, or add insecure/malicious dependencies that pose supply-chain risks.