Copilot will now fix your security warnings for you

Assign a CodeQL alert to Copilot and it wanders the repo, proposes a fix, re-runs CodeQL to prove the alert dies, then opens a draft PR. Batch up to 25 alerts into one PR, or poke it via the REST API (copilot-swe-agent[bot]). Default-branch alerts only; an enterprise admin has to flip on the “Agentic autofix” policy; it spends Code Security AI Credits + Actions minutes.