Agentic autofix now learns from Copilot Memory

GitHub says agentic autofix can now read existing Copilot Memory entries when resolving security alerts, if the customer has enabled the feature. Once a fix is created, its pattern can be stored as a memory for future work.

That context can help autofix with subsequent alerts and inform other Copilot features about a repository's secure development patterns. GitHub lists both agentic autofix and Copilot Memory as public previews.

Why repository memory matters

A code scanning alert identifies a risky path; it rarely contains the whole architecture. The autofix documentation says an agentic session can inspect more of the repository, propose a fix, validate it and open a pull request. The new Memory integration adds facts learned during earlier work, such as project-specific fix patterns.

GitHub's Memory overview distinguishes repository-level facts from user preferences and says facts learned by one Copilot feature can be used by another. That is useful in a large codebase where the correct remediation depends on local conventions. It also means a bad memory could travel beyond the single alert that produced it, so review matters.

The security caveat

This is still a proposal generator, not a security sign-off. GitHub lists agentic autofix as a public preview. A team should inspect the patch, rerun its security checks, and test behavior around the vulnerable path. If the agent remembers a pattern, verify that the pattern was actually the right fix before it becomes precedent.

Sources and further reading

• Original publication
• GitHub Docs: Copilot Memory
• GitHub Docs: autofix for code scanning