GitHub AI Scan for pull requests is now generally available, with advisory findings only

GitHub made AI Scan for pull requests generally available on October 15, 2026. It uses AI to look for vulnerabilities in languages and frameworks that CodeQL does not cover, such as PHP, Shell/Bash, Terraform, Dockerfiles, JSP for Java and Blazor for C#. Its findings are advisory and cannot block a merge.

That last point is the most important one for any team deciding whether to switch it on. Here is what the feature does, what it costs and where it fits next to CodeQL.

What AI Scan does

Per the GitHub Changelog entry, AI Scan complements CodeQL by checking pull request changes in languages and frameworks CodeQL does not currently support. GitHub names PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP for Java and Blazor for C#, and says there are more.

It runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are enabled. Findings show up on the Conversation and Files changed tabs with an "AI" label, and may include a risk explanation and a suggested autofix. It does not run on pull requests from forks or from Dependabot.

Advisory means it cannot gate a merge

GitHub says it plainly: "AI Scan findings are advisory." They do not fail the code scanning check and cannot block merges through rulesets.

That is a deliberate design choice, and a sensible one for a model-based scanner. A rules engine like CodeQL gives the same answer for the same code. A model can flag something one run and miss it the next, so GitHub keeps it out of the hard gate. The trade-off is that a team that wants AI Scan to be a required check cannot make it one today, per the changelog.

For a security lead, that means AI Scan is a second pair of eyes on code that previously had none from GitHub's own scanners, not a control you can point to in an audit as enforcing anything.

What it costs

AI Scan is free for public repositories owned by organizations or personal accounts. Private and internal organization repositories need GitHub Code Security or GitHub Advanced Security. No Copilot license is required.

Usage consumes Code Security AI Credits, which appear in the "AI usage" section of enterprise billing under "Advanced Security," and administrators can set budgets at the SKU level. GitHub's page links to usage-based billing documentation for the specifics. We did not find a per-scan price on the changelog, so we cannot say what a busy repository will pay. Set a budget before enabling it org-wide.

How it differs from CodeQL and Copilot Autofix

GitHub's documentation describes CodeQL as "the code analysis engine developed by GitHub to automate security checks." CodeQL produces code scanning alerts on a schedule or on events such as pushes. Copilot Autofix, by the same documentation, suggests fixes for alerts from that analysis, so it helps with remediation, not detection.

AI Scan adds a third piece: detection in places CodeQL does not look. The language list is telling. Terraform files, Dockerfiles and shell scripts are where infrastructure mistakes live, and where classic static analysis has historically been thinnest.

Tooling like this also sits inside a wider shift. Labs are now selling vulnerability discovery directly, which we covered in Anthropic's mission-critical infrastructure defense program. GitHub's approach differs: it puts the model inside the pull request workflow developers already use.

What the changelog does not tell you

It gives no accuracy figures. There is no false positive rate, no detection rate against a benchmark and no named model behind the feature. Those are the numbers a security team needs before it trusts the output, and none are published in the changelog entry.

Other reports in circulation mention batching up to 25 alerts for a related Agentic Autofix feature. The AI Scan changelog we reviewed does not mention that limit, so we are not relying on it here.

How we would roll it out

Start on a few repositories that are heavy on PHP, Terraform or shell, where CodeQL has little to say. Turn it on with a budget cap. Track how many AI-labeled findings your developers act on versus dismiss for a month, then decide whether to widen it. Treat the dismissal rate as your own accuracy benchmark, since GitHub has not given one.

Keep CodeQL as the gate for the languages it supports. AI Scan should sit alongside it, not replace it.

Questions to ask before you enable it

Security teams should settle a few things first. Who triages the AI-labeled findings, and how fast? Will developers see them in the pull request, where they can ignore them, or in a dashboard, where someone owns them? Is the credit budget set per repository or per organization? And what happens to findings that are dismissed: are they recorded so the team can estimate precision later? None of that is answered by the changelog, and all of it determines whether the feature produces fixes or just noise. Because findings are advisory, the process around them is what makes them count.

A note on timing

The changelog is dated October 15, 2026, and GitHub's billing and credit rules can change, so check the linked usage documentation on the day you enable it. Anything we say about pricing here reflects the changelog as we read it this week, and we would expect the credit schedule to evolve as usage data comes in.

Our take

This is a useful addition with honest guardrails. Making findings advisory is the right call for now, and the free tier for public repositories lowers the cost of trying it. But without published accuracy numbers, the claim is untested, and teams should measure it on their own code before putting weight on the output.