Summary
On October 15, 2026, GitHub made AI Scan for pull requests generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks CodeQL doesn't yet cover, such as PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, and Blazor, showing advisory findings with an 'AI' indicator alongside CodeQL results.
What changed
GitHub's AI Scan for pull requests hit GA. It runs automatically on PRs when code scanning and the repo's effective AI Scan setting are enabled, flags vulnerabilities in languages and frameworks CodeQL lacks (PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP for Java, Blazor for C#, and more), can add a risk explanation and suggested autofix, and marks results with an 'AI' indicator. Findings are advisory (they don't fail checks or block merges), and PRs from forks and Dependabot are skipped. It consumes Code Security AI Credits and needs no Copilot license.
Why it matters
AI Scan extends automated vulnerability detection to ecosystems CodeQL's static analysis doesn't cover, using models to broaden language support without hand-written queries. Keeping findings advisory lowers adoption friction while expanding GitHub's security surface and its new AI-credit billing model.
Evidence excerpt
AI Scan complements CodeQL by finding vulnerabilities in pull request changes in languages and frameworks CodeQL doesn't yet cover. Findings are advisory: they don't fail the code scanning check or block merges through rulesets.