GitHub AI Scan for repositories
An agentic whole-repository vulnerability scanner in GitHub code scanning that covers languages CodeQL does not support.
Overview
GitHub put AI Scan for repositories into public preview on October 28, 2026. An agentic scanner analyzes the latest commit on the default branch, focusing on code most likely to contain vulnerabilities within a fixed time budget, and reports findings in the code scanning alert list next to CodeQL results. It targets whole-repository issues, languages and frameworks CodeQL does not support, and issues rule-based analysis can miss; when CodeQL also scans a repository, AI Scan skips what CodeQL already reports. Alerts support assignees, linked pull requests, agentic autofix and security campaigns, but do not close automatically after a fix and need a rescan. No Copilot license is required.
This is a sourced directory entry. Features and capabilities are reported in the linked sources; this entry does not document independent Aymorphic testing.
Key features
- Whole-repository scans of the default branch rather than only PR diffs
- Covers languages and frameworks CodeQL does not support
- Fixed time budget per scan to bound cost
- Skips issues CodeQL already reports; alerts appear in the code scanning list
- Agentic autofix and security campaigns on findings
Use cases
- Finding vulnerabilities in codebases outside CodeQL's language support
- Supplementing rule-based scanning with an agentic review pass
Pricing
Consumes Code Security AI credits, shown under AI usage for the Advanced Security product; SKU-level budgets can be set. Private personal repositories are not supported; no dollar price listed.
Pricing reflects the source record and may change. Confirm current terms with the provider.
Dates and sources
- Released
- 28 Oct 2026
- Record updated
- 29 Oct 2026
- Record last checked
- 29 Oct 2026