---
title: "GitHub makes AI Scan and Agentic Autofix generally available, using AI to find and fix security flaws in code"
url: https://anawords.com/story/github-ai-scan-agentic-autofix-code-scanning-generally-available
published: 2026-10-16T14:37:48+05:30
updated: 2026-10-16T14:37:48+05:30
section: Tools & Apps
author: Mayank Sahu
checked: sources checked by AI, approved by editor
version: 1
---

# GitHub makes AI Scan and Agentic Autofix generally available, using AI to find and fix security flaws in code

AI Scan checks pull requests in languages GitHub’s CodeQL does not cover, such as PHP, Bash and Terraform. Agentic Autofix drafts a fix, reruns the scan and opens a pull request for review.

**In short:** GitHub made two AI security features generally available on 15 October 2026. AI Scan flags vulnerabilities in pull requests for languages CodeQL does not cover. Agentic Autofix fixes code scanning alerts, checks the fix with CodeQL and opens a draft pull request. Both use Code Security AI credits.

## What GitHub launched

GitHub announced two features as generally available on 15 October 2026.[^1][^2]

**AI Scan for pull requests** looks for security flaws in pull request changes alongside CodeQL, GitHub’s existing scanner.[^1] It covers languages and frameworks CodeQL does not yet handle, including PHP, Shell/Bash, Terraform, Dockerfiles, JSP for Java and Blazor for C#.[^1] Findings are marked “AI” and can include an explanation and a suggested fix.[^1]

**Agentic Autofix** takes a code scanning alert, explores the relevant files, proposes a fix and reruns CodeQL to check that the alert is closed.[^2] It then opens a draft pull request with its reasoning for a developer to review.[^2] Up to 25 alerts can be fixed together in one pull request.[^2]

## Limits

- AI Scan findings are advisory: they do not fail checks or block merges, and it does not run on pull requests from forks or from Dependabot.[^1]
- Agentic Autofix works only on alerts on a repository’s default branch.[^2]

## Who gets it and what it costs

AI Scan is available for public repositories. Private and internal repositories need GitHub Code Security or GitHub Advanced Security; a Copilot licence is not required.[^1] Agentic Autofix is for Code Security and Advanced Security customers on GitHub Enterprise Cloud and needs a Copilot billing method.[^2]

Both draw on Code Security AI credits, and Agentic Autofix also uses GitHub Actions minutes.[^1][^2] GitHub’s posts do not give per-credit prices.

## How to turn it on

For Agentic Autofix, an enterprise administrator must enable the policy, then an organisation or repository administrator switches it on in Code Security settings.[^2]

## Fact ledger

- [Confirmed] AI Scan for pull requests became generally available on 15 October 2026. (source 1)
- [Confirmed] Agentic Autofix became generally available on 15 October 2026. (source 2)
- [Confirmed] AI Scan covers PHP, Bash, Terraform, Dockerfiles and other formats CodeQL does not. (source 1)
- [Confirmed] AI Scan findings do not block merges. (source 1)
- [Confirmed] Both features use Code Security AI credits. (source 1,2)
- [Not known] The price per AI credit.

## Sources

1. [GitHub Changelog: AI Scan for pull requests generally available](https://github.blog/changelog/2026-10-15-ai-scan-for-pull-requests-generally-available/) — official
2. [GitHub Changelog: Agentic autofix for code scanning alerts general availability](https://github.blog/changelog/2026-10-15-agentic-autofix-for-code-scanning-alerts-general-availability) — official