GitHub has opened a public preview of code scanning for AI applications, a new detector that hunts for security flaws specific to software built around AI agents. Announced on 28 October 2026, the tool flags risks such as indirect prompt injection, sensitive information disclosure and excessive agency, and it runs automatically on new pull requests alongside GitHub’s existing CodeQL analysis.
What The Scanner Looks For
Indirect prompt injection tops the list, and GitHub describes it as the leading risk in the OWASP Top 10 for large language model applications. It happens when malicious instructions are hidden in untrusted content, such as a file, a web page or an issue comment, that an AI agent then reads.
If that agent also has access to tools, data or business systems, the hidden instructions can steer its behaviour or trigger actions nobody intended. That is the core danger the new detector is built to catch in production code for agent systems.
Sensitive information disclosure is the second category. It covers cases where an AI application or agent can reach sensitive data without appropriate authorisation controls, exposing that data to users or systems that should never have seen it. Excessive agency describes an agent given more capabilities, permissions or autonomy than its task requires, raising the chance of unintended actions.
The scanner traces the paths between those elements. It flags agent code paths where untrusted content can reach a model that has access to tools, data or business systems, and it provides mitigation guidance in the pull request so developers can address the risk before the code ships. Alerts appear on the Conversation and Files changed tabs of pull requests.
How It Fits Into GitHub’s Agent Push
The preview arrives in the middle of GitHub’s wider move toward agentic software delivery, set out at its Universe 2026 conference. In the same period GitHub made its Copilot Fusion model router generally available, letting the platform pick the model for each coding task.
It also launched Copilot Projects for work across repositories. Code scanning for AI applications is the safety counterpart to that expansion: as agents take on more of the work, the company is adding checks for the new failure modes agents introduce.
Access is limited for now. The detector runs in repositories where code scanning and scans for AI applications are enabled, and only for organisations using GitHub Advanced Security on github.com. It is not available on GitHub Enterprise Server at this time, and GitHub says coverage will expand beyond the initial set of agent risks.
Why It Matters
The tool matters because agent vulnerabilities are hard to catch by reading code alone. A traditional review can spot a bad query or a missing check, but the dangerous pattern in an agent system is often architectural and not visible in any single file.
That pattern is untrusted text flowing into a model that happens to hold powerful tools. A scanner that follows that data flow can surface a risk before it merges, when fixing it is still cheap and before users are exposed to it.
There are limits worth stating plainly. This is a public preview, not an independently measured guarantee, and a clean scan cannot prove an agent is safe in every prompt, tool or production state under real-world attack conditions, and it should not be treated as a certification.
Teams still need threat modelling, least-privilege permissions, adversarial testing, human review and runtime monitoring. The scanner is best understood as another review signal, not as permission to skip those disciplines. Skipping them would leave the largest production risks unaddressed today.
For the industry, the preview also signals where responsibility is moving. As agents become ordinary parts of production systems, the vendors that host the code are being asked to police agent-specific risks in the same way they already police SQL injection and leaked secrets. GitHub’s answer is to fold that policing into the pull request itself, where developers already work.
Background
GitHub’s announcement frames the detector as part of its existing code scanning product rather than a separate tool, which means teams already using Advanced Security can switch it on without adopting a new workflow. Whether it earns that trust will depend on its false-positive rate in real repositories, something only wider use in the preview period will reveal.
Source: GitHub changelog
0 Comments