GitHub makes AI Scan and agentic autofix generally available for code security

GitHub made two AI-assisted code security features generally available on October 15: AI Scan for pull requests and agentic autofix for code scanning alerts. The releases expand automated vulnerability detection and repair in different parts of a repository's workflow.

AI Scan checks pull request changes in languages and formats beyond CodeQL's current coverage, including PHP, Bash, Terraform configuration and Dockerfiles. Findings appear alongside CodeQL results but remain advisory: they cannot block merges, and the scan excludes pull requests from forks and Dependabot. Public repositories can use the feature without a Copilot license; private and internal organization repositories require GitHub Code Security or GitHub Advanced Security.

Agentic autofix instead lets teams assign code scanning alerts on their default branch to Copilot. GitHub says the agent inspects relevant files, proposes a repair, reruns CodeQL and opens a draft pull request for human review. Alerts found only on feature branches or pull requests are not eligible. Administrators must enable the capability, and GitHub says it consumes Code Security AI Credits and GitHub Actions minutes.