---
type: "post"
id: "github-code-scanning-for-ai-applications-enters-public-916659"
slug: "github-code-scanning-for-ai-applications-enters-public-916659"
title: "GitHub code scanning for AI applications enters public preview"
description: "GitHub has put code scanning for AI applications into public preview on github.com."
retrieval_nugget: "GitHub has put code scanning for AI applications into public preview on github.com. The feature automatically examines pull requests for certain agent and AI-application risks, including indirect prompt injection, sensitive-information disclosure, and excessive agency, giving teams a security signal before code is merged."
published_at: "2026-10-29"
updated_at: "2026-10-29"
record_date: "2026-10-29"
date_kind: "published_at"
topics: ["github","prompt-injection"]
entities: ["GitHub","GitHub Advanced Security","CodeQL","GitHub Enterprise Server","OWASP Top 10 for LLM Applications"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","agent-ready-software-exposes-capabilities"]
novelty_label: "new_fact"
what_changed: "GitHub adds public-preview scanning for AI applications and agent-specific risks, including indirect prompt injection, sensitive-data disclosure, and excessive agency; it requires GitHub Advanced Security."
prior_refs: ["memory:78c2635a-4f04-87d3-a65f-b96a5cf8ab38","memory:e8a9f223-240a-8e60-a46a-de3d4ab965bc"]
source_url: "https://github.blog/changelog/2026-10-28-code-scanning-for-ai-applications-in-public-preview"
source_urls: ["https://github.blog/changelog/2026-10-28-code-scanning-for-ai-applications-in-public-preview"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:github-code-scanning-for-ai-applications-enters-public-916659"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/github-code-scanning-for-ai-applications-enters-public-916659/","markdown":"https://newruntime.com/posts/github-code-scanning-for-ai-applications-enters-public-916659.md","json":"https://newruntime.com/posts/github-code-scanning-for-ai-applications-enters-public-916659.json"}
---

# GitHub code scanning for AI applications enters public preview

## Retrieval answer

GitHub has put code scanning for AI applications into public preview on github.com. The feature automatically examines pull requests for certain agent and AI-application risks, including indirect prompt injection, sensitive-information disclosure, and excessive agency, giving teams a security signal before code is merged.

## Summary

GitHub has put code scanning for AI applications into public preview on github.com. The feature automatically examines pull requests for certain agent and AI-application risks, including indirect prompt injection, sensitive-information disclosure, and excessive agency, giving teams a security signal before code is merged.

## What happened

On October 28, 2026, GitHub announced a public preview of code scanning for AI applications. The capability is aimed at codebases that contain AI applications or agents, particularly where an agent reads content it should not inherently trust and can also reach tools, data, or business systems. It runs as part of GitHub’s code-scanning workflow rather than as a separate manual review process.

GitHub says the new detector scans pull requests automatically when they are created, alongside existing CodeQL analysis. Its stated purpose is to flag agent code paths in which untrusted content can reach a model with access to tools, data, or business systems. Alerts come with mitigation guidance directly in the pull request, so reviewers and authors can address the identified risk before merging.

The announcement identifies indirect prompt injection as one covered class of issue. GitHub describes this as malicious instructions hidden in untrusted material such as a file, webpage, or issue comment that an AI agent reads. Where that agent also has access to tools, data, or business systems, the instructions may manipulate its behavior or lead to unintended actions. GitHub calls indirect prompt injection the top risk in the OWASP Top 10 for LLM Applications.

The preview also covers sensitive-information disclosure and excessive agency. In GitHub’s description, sensitive-information disclosure occurs when an AI application or agent can access sensitive data without appropriate authorization controls, potentially exposing it to people or systems that should not receive it. Excessive agency means an agent has more capabilities, permissions, or autonomy than its task requires, raising the chance of unintended or high-impact actions. The company says coverage will expand.

For organizations using GitHub Advanced Security, the detector begins scanning pull requests in repositories where both code scanning and scans for AI applications are enabled. Teams are instructed to review new alerts on the Conversation or Files changed tabs and use the guidance to remediate them before merge. The feature is in public preview on github.com, requires a GitHub Advanced Security license, and is not available on GitHub Enterprise Server at this time.

## What the archive adds

This is a new security-control event in a known GitHub security thread. Our earlier Field Note, [Updates to GitHub secret scanning](https://newruntime.com/posts/updates-to-github-secret-scanning-8b5197/), covered October product and API changes around secret scanning. The new preview is distinct: it targets architectural paths in AI applications and agents rather than secrets alone.

## Trend signal

This weakly supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). GitHub’s scanner does not establish a runtime boundary: it is static analysis on pull requests. But its focus on the combination of untrusted input, model behavior, and access to tools or sensitive systems reflects the same operational concern: an agent’s authority and data access matter more than a prompt asking it to behave safely.

## Connections to other events

The earlier secret-scanning update concerned protection of credentials and related operational signals in GitHub repositories. This preview addresses a different failure mode: whether the code connecting an agent to content, tools, and data creates an unsafe path before an agent reaches production.

## Why it matters

Teams building agents often review conventional application code and model prompts separately. GitHub’s preview frames a third review surface: the code path that joins external content to a model with consequential access. That is useful because indirect prompt injection is not merely text quality failure; in the described scenario, it becomes consequential when the agent can call tools, access data, or interact with business systems.

The feature can make that review more repeatable by placing alerts and mitigation guidance in the pull request where code changes are already discussed. It does not replace authorization design or testing, but it gives Advanced Security users a concrete place to surface risky integrations early. For teams already using GitHub code scanning, the immediate decision is whether relevant repositories should enable the additional scan and how alerts will be reviewed before merge.

## What happens next

- **GitHub expands the set of AI-application and agent risks covered by the detector.** (6 months, 70%). Watch for: changelog updates describing additional rules or vulnerability classes.
- **Teams using GitHub Advanced Security add this scan to repositories containing tool-using agents.** (3 months, 60%). Watch for: guidance or controls for enabling scans for AI applications across repositories.

## Limits and uncertainty

The announcement describes the categories of risk and the code paths the detector looks for, but it does not state the full rule set, detection accuracy, false-positive rate, or the precise remediation logic behind each alert. It also does not say whether an alert blocks a merge, how organizations should tune findings, or when the feature might reach GitHub Enterprise Server. Public preview status means coverage may change. The source establishes availability and intended behavior, not that static scanning can catch every prompt-injection path or authorization weakness in a deployed agent.

## Skill to build now

Map one agent feature in your repository as a path: identify the untrusted inputs it reads, the model invocation, and every tool, data source, or business system the model can reach. Then compare that map with the task’s actual authority. Where the agent has more access than it needs, reduce the permission or split the workflow. If the repository uses GitHub Advanced Security, enable the AI-application scan in a suitable repository and review how its pull-request alerts correspond to that map.

## Reader takeaway

GitHub is adding a pull-request security check for a specific agent failure pattern: untrusted content reaching a model that can act on tools, data, or business systems. Advanced Security customers can now evaluate it in public preview, but the underlying work remains designing narrow authority around agent tasks.

## Open question

How much useful coverage will the preview provide for real agent architectures, and how often will its findings identify issues that ordinary CodeQL analysis and human review would miss?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- topic hub: [Prompt Injection](https://newruntime.com/topics/prompt-injection.md): Explore the prompt-injection topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)