GitHub makes AI Scan and Agentic Autofix generally available, using AI to find and fix security flaws in code
AI Scan checks pull requests in languages GitHub’s CodeQL does not cover, such as PHP, Bash and Terraform. Agentic Autofix drafts a fix, reruns the scan and opens a pull request for review.
Illustration · not a photoHow this story was checked
- ResearchedWith AI assistance · 2 sources
- AI source checkEach sentence matched to its source
- Editor approvalMayank Sahu · 16 Oct, 14:37
- Published16 Oct, 14:37
Verify this story
- 2 sources, 2 official · 2 with an archived copy · see sources
- Every fact has a label and a source number · fact ledger
- What we searched, read and could not verify · research note
- Machine-readable: facts as JSON · text as Markdown
How this was made: researched, drafted and source-checked by AI (Claude, made by Anthropic), then published under the editor’s standing approval. A person did not read it line by line before it went live. AI policy
In short
GitHub made two AI security features generally available on 15 October 2026. AI Scan flags vulnerabilities in pull requests for languages CodeQL does not cover. Agentic Autofix fixes code scanning alerts, checks the fix with CodeQL and opens a draft pull request. Both use Code Security AI credits.
What GitHub launched
GitHub announced two features as generally available on 15 October 2026.12
AI Scan for pull requests looks for security flaws in pull request changes alongside CodeQL, GitHub’s existing scanner.1 It covers languages and frameworks CodeQL does not yet handle, including PHP, Shell/Bash, Terraform, Dockerfiles, JSP for Java and Blazor for C#.1 Findings are marked “AI” and can include an explanation and a suggested fix.1
Agentic Autofix takes a code scanning alert, explores the relevant files, proposes a fix and reruns CodeQL to check that the alert is closed.2 It then opens a draft pull request with its reasoning for a developer to review.2 Up to 25 alerts can be fixed together in one pull request.2
Limits
- AI Scan findings are advisory: they do not fail checks or block merges, and it does not run on pull requests from forks or from Dependabot.1
- Agentic Autofix works only on alerts on a repository’s default branch.2
Who gets it and what it costs
AI Scan is available for public repositories. Private and internal repositories need GitHub Code Security or GitHub Advanced Security; a Copilot licence is not required.1 Agentic Autofix is for Code Security and Advanced Security customers on GitHub Enterprise Cloud and needs a Copilot billing method.2
Both draw on Code Security AI credits, and Agentic Autofix also uses GitHub Actions minutes.12 GitHub’s posts do not give per-credit prices.
How to turn it on
For Agentic Autofix, an enterprise administrator must enable the policy, then an organisation or repository administrator switches it on in Code Security settings.2
Fact ledger
How labels workQuestions readers ask
Do I need Copilot to use AI Scan?
No. GitHub says a Copilot licence is not required for AI Scan.
Can AI Scan block a merge?
No. Its findings are advisory.
Is it free for open-source projects?
AI Scan is available for public repositories; usage draws on Code Security AI credits.