{"contract":"guth-news-publication-v1","article":{"article_id":"f0ce3759-1f18-4d60-adb0-597789430924","revision":1,"slug":"github-makes-ai-scan-and-agentic-autofix-generally-available-for-code-security-f0ce3759","title":"GitHub makes AI Scan and agentic autofix generally available for code security","summary":"GitHub's two releases expand AI-assisted vulnerability detection and repair, with distinct repository eligibility, advisory findings and usage charges.","body":"GitHub made two AI-assisted code security features generally available on October 15: AI Scan for pull requests and agentic autofix for code scanning alerts. The releases expand automated vulnerability detection and repair in different parts of a repository's workflow.\n\nAI Scan checks pull request changes in languages and formats beyond CodeQL's current coverage, including PHP, Bash, Terraform configuration and Dockerfiles. Findings appear alongside CodeQL results but remain advisory: they cannot block merges, and the scan excludes pull requests from forks and Dependabot. Public repositories can use the feature without a Copilot license; private and internal organization repositories require GitHub Code Security or GitHub Advanced Security.\n\nAgentic autofix instead lets teams assign code scanning alerts on their default branch to Copilot. GitHub says the agent inspects relevant files, proposes a repair, reruns CodeQL and opens a draft pull request for human review. Alerts found only on feature branches or pull requests are not eligible. Administrators must enable the capability, and GitHub says it consumes Code Security AI Credits and GitHub Actions minutes.","content_kind":"author_paraphrase","explanation":{"feature":"GitHub's two releases expand AI-assisted vulnerability detection and repair, with distinct repository eligibility, advisory findings and usage charges.","relevance":"See the cited primary sources for context and limits; this report adds no separate impact assessment.","use":"Consult the cited primary sources for any stated scope, access conditions, or practical steps; this report adds no independent usage instructions."},"announcement_date":null,"published_at":"2026-10-17T17:03:18.347Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-17T17:03:17.503Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/news-writer/autopublish/f0ce3759-1f18-4d60-adb0-597789430924","checker_models":["@cf/openai/gpt-oss-120b"],"claims":[{"claim_id":"claim:s1","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:s2","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:s3","evidence_refs":["source:1"]},{"claim_id":"claim:s4","evidence_refs":["source:1"]},{"claim_id":"claim:s5","evidence_refs":["source:1"]},{"claim_id":"claim:s6","evidence_refs":["source:2"]},{"claim_id":"claim:s7","evidence_refs":["source:2"]},{"claim_id":"claim:s8","evidence_refs":["source:2"]},{"claim_id":"claim:s9","evidence_refs":["source:2"]}]},"primary_sources":[{"source_id":"source:1","title":"AI Scan for pull requests generally available","url":"https://github.blog/changelog/2026-10-15-ai-scan-for-pull-requests-generally-available","fetched_at":"2026-10-16T15:09:01.309Z","sha256":"647ba799afd25c28f75c07288e34c38b8cb686be1057a9d49ae54eda98a6447f","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"},{"source_id":"source:2","title":"Agentic autofix for code scanning alerts general availability","url":"https://github.blog/changelog/2026-10-15-agentic-autofix-for-code-scanning-alerts-general-availability","fetched_at":"2026-10-17T14:19:36.428Z","sha256":"035a934c716b3cf462d049f0742c13b2e801f544850ac0f9c90b1883e1575b85","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"b305c16d-2448-4794-ac23-9ed2bb89ee8e","envelope_sha256":"3fbb640356187f903f723fb5117d587cdadb63001ce8e7b97a2ac8f30c2b6d7c"},"canonical_url":"https://guth.news/articles/github-makes-ai-scan-and-agentic-autofix-generally-available-for-code-security-f0ce3759"},"ai_generated":true,"history":[{"revision":1,"published_at":"2026-10-17T17:03:18.347Z","reviewed_at":"2026-10-17T17:03:17.503Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"GitHub makes AI Scan and agentic autofix generally available for code security","change_summary":"First published version.","url":"https://guth.news/articles/github-makes-ai-scan-and-agentic-autofix-generally-available-for-code-security-f0ce3759?revision=1"}]}