GitHub announced a public-preview security extension for its Copilot app on October 28. The extension lets developers find and work through GitHub code-scanning alerts from within a Copilot session rather than repeatedly switching between an issue list and a code editor.
For a small software shop, the highest-value test is a repository with an existing noncritical CodeQL alert. Ask the agent to explain the vulnerable path, propose a minimal patch and add a regression test. Review the actual diff and verify the scanner result; an AI-generated security explanation is not itself proof of remediation.
Because the extension is in preview, check the official GitHub release notes for account eligibility and repository permissions. Do not enable an unattended agent with write access across every project merely to experiment with one alert.
Go to Source — [github.blog](https://github.blog/changelog/month/10-2026/) https://github.blog/changelog/month/10-2026/