GitHub says customers decide which Agentic Autofix patches merge
Original title: GitHub Agentic Autofix and the question of who owns a bad AI patch
The agent re-runs detection and project tests, and CISOs can pace grouped campaigns instead of opening thousands of pull requests.
In a Help Net Security interview, GitHub VP Marcelo Oliveira said GitHub is accountable for suggested-fix quality while customers decide what is merged. Agentic Autofix re-runs detection engines and project tests, and campaigns let customers set the pace rather than converting an alert backlog into pull requests. He also described model-swap evaluations and argued that safer codebases show less high-risk exposure, not only faster alert closure.
Unconfirmed: The four-times fix rate and 1.5 million hours are GitHub’s own interview claims, not independently verified.
- GitHub claims a four times higher backlog fix rate than human-only baselines.
- The company says Autofix saved more than 1.5 million review hours in 2025.
- New models are enabled only after internal safety and secure-code tests.
- Oliveira says developers still see explanations that can support security learning.
- Vendors
- GitHub
From the original article
4 min read at helpnetsecurity.com
In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated patch fixes one flaw and introduces another. He explains how Agentic Autofix re-runs detection engines and project tests, and what a CISO should change before pointing an agent at thousands of old alerts.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.