GitHub releases AI security scans for code changes, but findings cannot block merges

GitHub is broadening automated security review without giving its AI findings the power to stop code changes. On October 15, 2026, it made AI Scan for pull requests generally available. GitHub says the tool finds vulnerabilities beyond CodeQL’s current language and framework coverage, but its findings remain advisory rather than mandatory barriers to merging code.

Coverage beyond CodeQL

AI Scan complements CodeQL rather than replacing it. It examines changes in pull requests—proposals to merge code into a repository—and targets languages and frameworks that CodeQL does not currently cover. GitHub lists PHP, Shell/Bash, Terraform configuration written in HCL, Dockerfiles, JSP for Java and Blazor for C# among the supported examples.

The scan runs automatically when both code scanning and the repository’s effective AI Scan setting are enabled. Enabling code scanning alone is not enough: AI Scan must also be enabled under the settings that apply to the repository.

Developers see the findings alongside CodeQL results in the pull request’s Conversation and Files changed tabs. An AI indicator distinguishes them from CodeQL alerts. Findings can include an explanation of the security risk and a suggested autofix.

Two kinds of pull requests are excluded

Automatic scanning does not mean every pull request is eligible. AI Scan does not run on pull requests from forks or on pull requests created by Dependabot. Those exclusions concern whether a scan happens at all, rather than what developers can do with a finding after it appears.

Repository access and the credit bill

Availability depends on the repository’s visibility and ownership. GitHub lists two access paths, with a security-product requirement for private and internal repositories owned by organizations:

• Public repositories: AI Scan is available for repositories owned by either organizations or personal accounts.
• Private and internal organization-owned repositories: access requires GitHub Code Security or GitHub Advanced Security.

A GitHub Copilot license is not required. That does not remove usage-based billing: AI Scan consumes Code Security AI Credits. Access without Copilot should not be confused with access without a credit cost.

GitHub places that consumption in the AI usage section of enterprise billing and licensing, under the Advanced Security product. Administrators can also set budgets for the specific Code Security AI Credits billing category.