The Pulse
GitHub Previews AI-Agent Risk Scanning Alongside CodeQL
GitHub has opened AI applications scanning in public preview for pull requests, targeting risks such as indirect prompt injection. The detector uses an LLM-based approach, is separate from CodeQL, and requires GitHub Advanced Security plus
AI.info Team · Written with AI · fact-checked ·
GitHub’s new AI applications scanner does not run on CodeQL: it uses an LLM-based detector to flag risks in AI agents’ code paths, including indirect prompt injection. Announced on October 28, the feature is in public preview and scans pull requests. GitHub’s changelog says it runs alongside existing CodeQL analysis, but its documentation makes clear the detector is separate from CodeQL and from GitHub’s AI Scan for traditional code vulnerabilities.
A separate detector for agent-specific risks
The scanner looks for patterns and data flows that could let untrusted content influence an AI model with access to tools, data, or business systems. A malicious instruction in a webpage, document, or API response could steer an agent toward unintended actions. GitHub’s announcement also describes sensitive information disclosure and excessive agency as risks the feature is intended to address.
There is an important limit to that broader description: GitHub’s documentation says the public preview detects only indirect prompt-injection vulnerabilities in AI agents. The same documentation says the detector uses an LLM-based approach rather than CodeQL’s language-specific static analysis. GitHub says that approach has no language or framework limitations, though the preview’s stated detection coverage remains narrower than the full set of risks described in the announcement.
Pull requests only, and advisory
Scans run when a pull request opens and after each new commit, according to GitHub’s documentation. Findings appear as pull-request comments and include Copilot Autofix suggestions. They are advisory: they do not stop a merge, and they cannot be used in rulesets to enforce merge requirements.
The detector does not scan an entire repository or an existing alert backlog for AI-application risks. It also skips pull requests from forks and those created by Dependabot. That scope makes the feature a review aid for changes under development, not a repository-wide audit of deployed agents.
Separate setup and AI-credit costs
Organizations must enable AI applications scanning separately from AI Scan for pull requests, even though both features share an enterprise-level policy. The feature requires a GitHub Advanced Security license and consumes AI credits in addition to that license; GitHub says eligible public repositories are subject to the same billing requirement. The changelog says the preview is available on github.com and not on GitHub Enterprise Server, while the documentation specifies GitHub Enterprise Cloud, including data-residency deployments.
For security teams, the distinction matters: enabling CodeQL or GitHub’s other AI-based code scanner does not by itself turn on this detector. Administrators need to allow the feature at the enterprise level, organizations must enable it for eligible repositories, and repository administrators can opt out. In the preview, the scanner’s practical promise is limited to spotting indirect prompt injection in pull-request changes—and its findings remain suggestions rather than merge controls.