GitHub Launches AI Scan for Pull Request Code Security
GitHub's new AI scan analyzes code changes in languages CodeQL doesn't cover, and runs automatically on every pull request.
GitHub officially launched "AI scan" on October 15, 2026, a feature that uses AI to detect security vulnerabilities in code changes (pull requests), according to zdnet.co.kr. The company also officially launched "agent auto-fix," a feature in which an AI agent fixes code scanning warnings, the same day.
AI scan examines code in languages and formats not supported by GitHub's existing CodeQL tool: PHP, shell scripts, Terraform, Dockerfile, JSP, and Blazor. When code scanning and AI scan are enabled in a repository, AI scan runs automatically whenever a pull request is created.
Results appear in the pull request's conversation tab and changed files tab with an "AI" mark, distinguishing them from CodeQL warnings, and may include explanations of risks and fix suggestions. AI scan is a reference-only feature: it does not fail checks or block code merges.
Requests from forked repositories and requests auto-generated by the Defender bot are not scanned. AI scan is free for public repositories; enterprise private and internal repositories require a GitHub Code Security or GitHub Advanced Security subscription.
A Copilot license is not required, and usage is deducted via "Code Security AI credits," for which enterprise administrators can set budget limits. The "agent auto-fix" feature was first released as a public preview in July 2026.
Quick answers
Which languages does GitHub's AI scan cover?
AI scan examines PHP, shell scripts, Terraform, Dockerfile, JSP, and Blazor, which are not supported by GitHub's existing CodeQL tool.
Does AI scan block code merges?
No. AI scan is a reference-only feature: it does not fail checks or block code merges.
Is a Copilot license required for AI scan?
No. A Copilot license is not required, and usage is deducted via "Code Security AI credits," for which enterprise administrators can set budget limits.