GitHub Lets Teams Assign Dependabot Alerts to AI Coding Agents

GitHub announced on April 7, 2026 that Dependabot alerts can now be assigned directly to AI coding agents for remediation. From the Dependabot alert detail page, users can choose Assign to Agent and send the issue to Copilot, Claude, or Codex. GitHub said the selected agent will analyze the advisory and the repository's dependency usage, open a draft pull request with a proposed fix, and attempt to resolve any test failures introduced by the update.

The feature is aimed at a specific problem in software supply chain security: not every vulnerable dependency can be fixed with a straightforward version bump. Major upgrades often break APIs, deprecate methods, or introduce incompatible type signatures, which means the remediation work spills into application code. GitHub's position is that Dependabot should continue to handle the package update while coding agents take over the harder follow-on work that requires repository-specific reasoning.

Where GitHub sees value

GitHub highlighted several scenarios where agents can help. If a dependency update breaks builds or tests, an agent can analyze the failure and propose code changes to restore compatibility. If a package has been compromised or contains malware and no patched version exists, an agent can help downgrade to the last known safe release. For complex remediation cases that go beyond Dependabot's existing rules engine, agents can open draft pull requests that development teams can compare and refine. Multiple agents can also be assigned to the same alert, with each one opening its own draft pull request.

GitHub was explicit that AI-generated fixes are not guaranteed to be correct. The company said teams should review every pull request, confirm that tests pass, and verify that the proposed remediation is appropriate before merging. Access is limited to organizations with GitHub Code Security and a Copilot plan that includes coding agent access. The launch matters because it extends AI from code generation into vulnerability remediation, but GitHub is still drawing a clear line: automation can accelerate the work, yet final judgment remains with human reviewers.