October 28, 2026
GitHub has added code scanning for AI applications to its security toolkit, putting a detector for agent-specific risks — starting with indirect prompt injection — directly into pull requests. Why it matters: as teams wire AI agents into codebases with access to tools, data and business systems, the riskiest design flaws are architectural, and they are easy to miss in a manual review.
What happened
GitHub announced on Wednesday that code scanning for AI applications is now in public preview on github.com. The detector runs automatically on new pull requests, alongside existing CodeQL analysis, in repositories where code scanning and scans for AI applications are enabled. It requires a GitHub Advanced Security license and is not available on GitHub Enterprise Server for now.
What it looks for
GitHub says the initial coverage includes three classes of AI-specific risk, with more to come as coverage expands. Indirect prompt injection — the top risk in the OWASP Top 10 for LLM Applications — happens when malicious instructions are hidden in untrusted content an agent reads, such as a file, a webpage or an issue comment; if that agent can also call tools or reach data, the hidden instructions can steer its behavior. Sensitive information disclosure covers agents that can reach sensitive data without proper authorization controls. Excessive agency covers agents given more capabilities, permissions or autonomy than their task needs.
In practice, the scanner traces code paths where untrusted content can reach a model that has access to tools, data or business systems, flags them on the pull request’s Conversation or Files changed tab, and adds mitigation guidance so developers can fix the problem before merging.
Why it matters
This is the agent-security problem moving from conference talks into default developer tooling. A prompt-injection flaw is not a typo a linter catches — it is a data-flow problem, and data flow is exactly what code scanning is built to trace. The honest limits: this is a public preview, and everything known about its detection quality so far comes from GitHub’s own product description. There is no independent measurement of how many real risks it catches or how many false alarms it raises, and a clean scan cannot prove an agent is safe in production. Treat it as an extra review signal alongside threat modeling, least-privilege permissions and human review — not a replacement for them. Everything AI, tested: a useful early warning, not a safety certificate.
Frequently asked questions
What does GitHub’s code scanning for AI applications detect?
It flags AI application and agent vulnerabilities in pull requests, including indirect prompt injection, sensitive information disclosure and excessive agency, with additional AI-specific risks planned as coverage expands.
Who can use it?
Organizations with a GitHub Advanced Security license, on github.com, in repositories where code scanning and scans for AI applications are enabled. It is not available on GitHub Enterprise Server during the preview.
Does it replace CodeQL or human review?
No. It runs alongside existing CodeQL analysis and adds mitigation guidance in the pull request. GitHub has published no independent detection or false-positive benchmarks for the preview, so teams should keep their own threat modeling and review process.
Sources: GitHub Changelog, GitHub documentation.