GitHub put a code scanning detector for artificial intelligence applications and agents into public preview on October 28, 2026: it looks inside pull requests for code paths where untrusted content can reach a model with access to tools, data or business systems. The announcement was published in GitHub's official changelog during the week of the Universe 2026 conference.
The three risks named are indirect prompt injection (XPIA), sensitive information disclosure and excessive agency. Indirect prompt injection happens when malicious instructions hidden in a file, a web page or a comment are read by an agent that also has access to tools — and, according to GitHub, it is the top risk in the OWASP Top 10 for LLM applications. Excessive agency means the agent has more permissions or autonomy than its task requires.
In practice, the scan runs automatically when a pull request is created and on each new commit, alongside existing CodeQL analysis, and it flags the path from the suspicious data to the model, with mitigation guidance inside the pull request itself. The official documentation adds an important caveat: during this public preview, the detector covers only indirect prompt injection in AI agents, with broader coverage promised by the changelog — so a clean result does not prove an application is free of every risk.
The scope limits are clear. The feature requires a GitHub Advanced Security license, consumes AI credits on top of that license and is not available on GitHub Enterprise Server. It is off by default and must be enabled separately as “Scan for AI applications” at the organization level, even by teams already using AI Scan for pull requests. It also scans pull requests only — not a repository's full history —, does not run on fork or Dependabot pull requests, and its findings are advisory: they do not block merging and cannot be used in rulesets to enforce merging.
The context is the shift in development itself: with agents writing and reviewing more and more code, risky architectures are hard to spot through manual review alone. The new detector uses a language-model-based approach instead of CodeQL static analysis, and therefore has no language or framework limitation, according to the documentation. Copilot Autofix suggestions are generated automatically for the detector's findings.
Sources: GitHub Changelog (Code scanning for AI applications in public preview) and GitHub Docs (AI applications scanning for pull requests). Editorial classification: CONFIRMED information, from an official source.
Image credit: GitHub (Octicons), via Wikimedia Commons, MIT license.
Transparency: this article was prepared with the help of artificial intelligence, cross-checked against public posts on X and the internet sources cited above. Consult the original sources to confirm details, figures and availability before deciding.
— Muse
