GitHub Rolls Out AI Scan to Cover What CodeQL Misses

GitHub moved AI Scan to general availability on October 15, 2026. The tool uses a language model to catch vulnerabilities in languages and frameworks that CodeQL, the platform’s long-standing static analysis engine, doesn’t natively cover. The rollout follows a public preview opened in July and a loosening of requirements in September.

#A detector built to close CodeQL’s blind spots

CodeQL remains the reference tool for the languages it supports, but many repositories mix application code with infrastructure, deployment, or configuration scripts that classic static analysis ignores. AI Scan fills that gap: it runs automatically on pull requests and flags potential issues in files CodeQL leaves untouched, without replacing it on its own turf.

#Languages and frameworks covered

GitHub’s announced list includes PHP, Bash and Shell, Terraform (HCL), Dockerfiles, JSP for Java, and Blazor for C#. For an ecosystem like PHP, where much of the legacy application code escapes modern static analyzers, the coverage is far from a footnote.

#What teams see on a pull request

AI Scan findings appear alongside CodeQL’s, on the Conversation and Files changed tabs, with an “AI” badge that sets them apart from classic alerts. Each finding can include a risk explanation and a suggested fix. Turning it on requires enabling the repository’s AI Scan setting, itself gated behind code scanning.

# Check AI Scan status on a repo via the GitHub API
gh api \
  -H "Accept: application/vnd.github+json" \
  /repos/ORG/REPO/code-scanning/default-setup \
  --jq '.state, .query_suite'

# Public repositories (personal or org-owned) are eligible without a Copilot license;
# private or internal repos need GitHub Code Security or Advanced Security.

AI Scan never blocks a merge: its findings stay advisory, unlike CodeQL alerts that can be required before merge through a ruleset.

GitHub’s choice to keep AI Scan purely advisory stands apart from code scanning rulesets, built to enforce a quality bar before merge. For teams running legacy PHP codebases, the WordPress ecosystem included, catching vulnerabilities in code that routine hardening practices don’t always reach upstream can close a real gap, as long as it isn’t mistaken for a blocking safety net.

#Why this design choice

By keeping AI Scan findings out of the merge path, GitHub limits the risk of blocking false positives, a well-known problem with AI-assisted analysis tools. The tradeoff is that teams need to fold this stream of findings into their review routine, alongside the command-line tools already in daily use for linting, dependency scanning, or review assistance.

#Key takeaways

AI Scan reaches general availability with a clearly scoped job: complementing CodeQL on infrastructure and configuration languages, without ever blocking a merge. Coverage of PHP, Bash, and Terraform speaks directly to teams running legacy web applications alongside their infrastructure as code. The AI credit cost and the lack of scanning on forks remain the two points worth checking before rolling it out broadly.

Further reading: the official announcement on the GitHub Changelog.