GitHub previews whole-repository AI Scan with separate controls and billing
GitHub announced AI Scan for repositories in public preview on October 28. It analyzes the latest commit on a repository's default branch, rather than only pull-request changes. Findings appear in the code scanning alert list alongside CodeQL findings.
The agentic scanner focuses on code it considers most likely to contain vulnerabilities and runs within a fixed time budget. GitHub says it covers languages and frameworks beyond CodeQL's coverage and can find issues that rule-based analysis misses. That does not establish exhaustive coverage or guarantee that every reported issue is exploitable.
Enterprise policy must allow AI Scan, and organization owners or security managers then enable the repository-scanning feature for their organization. Personal-account repositories use repository settings. This setting is separate from AI Scan for pull requests, so enabling one does not establish that the other has run.
AI Scan skips issues already reported by CodeQL when both scan the same repository. Rescans retain findings that are detected again and report new findings. Merging a fix does not automatically close an AI Scan alert; another scan is needed to check the fix and close resolved alerts.
The preview is available on github.com and Enterprise Cloud with data residency, without requiring a Copilot license. Organization-owned public repositories are supported, while private and internal organization repositories require Code Security or Advanced Security. For personally owned repositories, only public repositories are supported.
Scans consume Code Security AI credits, and SKU-level budgets can be set. Personal public-repository usage normally bills the owner, but an organization-provided Copilot license can make that organization or enterprise the payer. A bounded scan is not a free scan, and teams should verify the billing account and remaining budget before starting one.