GitHub announced on July 14, 2026 that Code Scanning would surface AI-powered security detections directly in pull requests. The public preview extends vulnerability coverage to some languages and frameworks that CodeQL does not currently support natively, reducing blind spots in a repository.
The new findings appear in the pull request so developers can review them before merging. GitHub says AI-generated results are labeled AI, which helps teams distinguish them from native CodeQL analysis. That label matters for triage because the evidence source and confidence model are not identical across analysis engines.
AI security detections run automatically when a pull request is opened or updated, and results are returned as the engine produces them rather than waiting for every analysis source to finish. GitHub also says the findings are informational and do not block merges. This makes the feature an additional coverage layer, not a deterministic release gate on its own.
There are clear enablement requirements. An enterprise owner must allow the feature, an organization must enable it for repositories using GitHub Code Security, and the repository must have CodeQL default setup enabled. The preview is available on github.com for GitHub Advanced Security customers; it requires a Copilot license and consumes organization AI credits when detections run.
The practical benefit is timing: a security signal reaches developers in the same review surface where the change is already being discussed. The feature should not replace CodeQL, Dependabot, secret scanning, or human review. Teams still need to validate the finding’s context, test the remediation, and account for severity, false positives, and AI credit usage.
For AI-assisted development, the update shows the security loop moving closer to the code-generation loop. When an agent helps create or change code and the detection appears in the same pull request, “generate, inspect, remediate, approve” can become a governed workflow. The final approval responsibility should still remain with a person.
