GitHub brings AI security detections into pull request code scanning

GitHub has put a new AI-assisted security signal directly into the pull request workflow, expanding code scanning beyond the languages and frameworks that CodeQL already covers. In a July 14 changelog post, the company said AI security detections are now available in public preview on github.com for customers using GitHub Code Security, formerly GitHub Advanced Security.

The feature is meant to surface possible vulnerabilities before code is merged. When a pull request is opened or updated, GitHub's AI detection engine can analyze the change and return findings into the same code scanning experience developers already use. GitHub says those alerts are labeled as AI-generated, which should help teams separate them from CodeQL results during review and triage.

What Changes For Security Teams

The practical change is coverage. CodeQL remains GitHub's mature static analysis engine, but its built-in queries do not cover every language, framework, or project shape. GitHub is positioning the AI detector as a way to reduce blind spots in repositories that already have CodeQL default setup enabled. The company says the findings are informational during the preview and will not block pull request merges.

That limitation matters. AI-generated security findings can be useful as an early warning, especially for code that would otherwise receive little automated review, but teams will still need human validation and normal security triage. Labeling the alerts and keeping them non-blocking during preview should make it easier to evaluate precision without suddenly changing release gates.

Availability And Cost

GitHub says the preview must be allowed at the enterprise policy level, enabled at the organization level, and used on repositories with CodeQL default analysis turned on. It is available for repositories or organizations with GitHub Code Security on github.com.

The billing model is also notable. During public preview, AI security detections require a GitHub Copilot license and consume an organization's AI credits only when detections run. That ties the security feature to GitHub's broader Copilot usage economy, so engineering leaders testing it will need to watch both alert quality and credit consumption. For teams already standardizing on GitHub code scanning, the preview is another sign that application security checks are moving closer to everyday development instead of living only in separate audit tools.

Sources

• github.blog

Cover photo by Sora Shimazaki on Pexels, used under the Pexels License.