Microsoft extends Copilot Autofix in Azure DevOps to vulnerable dependencies and alerts from other tools
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Microsoft has widened Copilot Autofix, which suggests security corrections in Azure DevOps, to vulnerable packages and to warnings from scanners other than CodeQL. It now leans on a Copilot agent that studies the repository and respects the guidance each team gives it. The feature remains in limited preview, every fix spends AI credits and a public preview is due in November.
On Wednesday, October 21, Microsoft announced on the Azure DevOps blog that it is extending Copilot Autofix, the feature in GitHub Advanced Security for Azure DevOps (the code security service of its software development platform) that suggests fixes for the vulnerabilities it finds. The feature now relies on an agent: it draws on Copilot's coding agent to look through the repository's context, and it can check and polish its own changes before handing back a suggestion.
Until now it only produced fixes for a limited set of rules in CodeQL, GitHub's code analyzer. It now also suggests them for alerts raised by other code analysis tools and for vulnerable dependencies, the packages with security flaws that a project relies on. For those, a fix is requested from the alert itself, and the tool can open a pull request containing the proposed change along with an explanation, which goes through the same review process as any other code. The team has the final say on what gets merged.
Teams can give it their own instructions and skills, stored in the .github or .agents folders of the repository, for example so that it uses their approved data validation function or follows their procedure for updating packages. To help decide which alerts to handle first, Advanced Security shows the EPSS percentile of each dependency alert when data is available. EPSS is a system that estimates how likely a vulnerability is to be exploited in real attacks; a higher percentile means the flaw ranks higher in that estimate relative to others, not the probability that someone will attack a specific application. In supported ecosystems, it also tells apart dependencies used only during development from those that run in the application.
The feature is switched on with a single button at organization, project or repository level, and the alerts to fix are then picked one by one. The rollout will take two to three weeks; for now it is in a limited public preview for enrolled organizations, and Microsoft expects to open the public preview in November. Producing fixes uses up AI credits, turning the feature on does not create fixes by itself, and not every request yields one. Microsoft advises reviewing all the changes, building and running tests before merging the proposed code. The announcement does not say how many credits each fix uses.
Why it matters · analysis and opinion
The heavy lifting on a security warning used to start once the scanner had finished: someone had to understand the flaw, find the right package version and check that nothing broke. Having the tool propose the change and open the request itself shortens that path, especially for dependencies, where warnings with no owner tend to pile up. The savings depend on two things the announcement leaves open: how much the credits for each fix cost and how often the proposal works the first time. Teams using Azure DevOps can start preparing instructions with their internal rules now, since that is what will make the suggestions fit their code, and keep human review and tests in place before accepting any change.
Official source: Microsoft · Written with the help of AI: how we make the news
