GitHub AI Scan Becomes a Governable Security Control, Not Just a Pull-Request Feature

GitHub AI Scan has moved from being mainly a pull-request detection feature toward a programmable security-control layer. On September 10, 2026 GitHub added organization- and repository-level REST APIs for enabling and disabling AI Scan, and on September 16 it removed the previous requirement that a repository use CodeQL default setup before AI Scan could run.

The two changes matter together. The first makes deployment governable at fleet scale; the second expands the set of eligible repositories. Both are still public-preview capabilities for GitHub Advanced Security customers on GitHub.com, and GitHub Enterprise Server is excluded from these releases.

What changed on September 10

GitHub introduced four REST operations around AI Scan for pull requests:

organization
  /orgs/{org}/code-scanning/ai-scan
        |
        +--> read organization setting
        +--> update organization setting

repository
  /repos/{owner}/{repo}/code-scanning/ai-scan
        |
        +--> read repository setting
        +--> update repository setting

The organization setting controls whether repository-level AI Scan can run. A repository cannot override an organization-level disabled state.

That hierarchy is important because it turns a UI toggle into a policy surface that can be inspected and managed as configuration.

What changed on September 16

GitHub then removed the CodeQL default-setup prerequisite for AI Scan for pull requests.

Previously, a repository needed CodeQL default setup configured before AI Scan could operate. GitHub's September 16 changelog says eligible repositories can now use AI Scan without that prerequisite.

The change does not make AI Scan universally available. GitHub still requires the relevant code-scanning and AI Scan settings, and the September release remains a public preview on github.com for GitHub Advanced Security customers.

GitHub Enterprise Server is not supported for this release.

The architectural shift is about governance

The interesting change is not that an AI model can inspect code. GitHub already had that capability.

The new layer is administrative:

repository inventory
       |
       v
security policy
       |
       +--> organization ceiling
       |
       +--> repository enablement
       |
       v
AI Scan on pull requests
       |
       v
security findings

A large organization can now represent AI Scan participation in scripts, internal policy tooling or configuration audits instead of relying exclusively on manual UI settings.

That is a different kind of maturity from better model accuracy. It makes the feature easier to operate consistently.

AI Scan does not replace CodeQL

The September changes should not be interpreted as GitHub replacing CodeQL with an LLM.

CodeQL and AI Scan occupy different parts of the security-analysis stack. CodeQL is a deterministic program-analysis system with language-specific queries and data-flow reasoning. AI Scan adds model-based security detections intended to broaden coverage around pull-request changes.

The Observatory's earlier Google agentic security workflow shows a related pattern from another organization: AI can participate in vulnerability discovery and remediation, but engineering controls and validation remain part of the surrounding system.

GitHub's own June announcement on security validation for third-party coding agents similarly described CodeQL, dependency checks and secret scanning as separate automated controls around agent-generated changes.

The useful mental model is therefore layered analysis, not AI replacing static analysis.

Why removing the CodeQL prerequisite matters

A prerequisite can be technically reasonable while still becoming a deployment bottleneck.

If an organization has thousands of repositories and only some use CodeQL default setup, tying AI Scan eligibility to that configuration creates a dependency between two rollout programs.

Removing the dependency allows security teams to ask a simpler question:

Which repositories should receive AI-assisted pull-request detection?

That can be answered independently of whether the repository has already completed the CodeQL default-setup rollout.

It also means the organization needs a clearer inventory of effective coverage. A repository that lacks CodeQL default setup is no longer automatically outside AI Scan's scope, but that does not mean it is necessarily configured to use AI Scan.

The organization-level ceiling matters

The API hierarchy creates an important policy rule:

Enterprise policy
       |
       v
Organization AI Scan setting
       |
       v
Repository AI Scan setting
       |
       v
Effective pull-request coverage

If an organization disables AI Scan, a repository cannot simply enable itself below that ceiling.

That is useful for centralized governance. It also means that looking only at repository-level configuration can produce a misleading inventory.

A serious rollout should therefore calculate effective state, not just stored state.

This is where the feature becomes an infrastructure concern

Security features often start as product capabilities and later become fleet-management problems.

For a small repository, clicking a security setting once may be enough. For hundreds or thousands of repositories, administrators need to know:

• which repositories are eligible;
• which are enabled;
• which are blocked by organization policy;
• which are actively producing scans;
• which teams own exceptions;
• and whether the additional findings justify the operational cost.

The new APIs provide the control-plane primitive for that inventory.

They do not automatically provide the governance process around it.

AI Scan is still a preview

The preview status matters.

GitHub says the September changes are available on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported for these releases.

That creates a meaningful deployment split. An organization using GitHub.com can begin experimenting with centralized rollout, while an organization running self-hosted GitHub Enterprise Server cannot assume the same feature set is available.

The feature should therefore be evaluated against the actual deployment model rather than the GitHub.com documentation alone.

Findings are not the same as merge enforcement

Another important distinction is between finding a vulnerability and blocking a merge because of a vulnerability.

AI-assisted detection can surface a problem for review without becoming a deterministic merge gate. That means teams should not interpret broader AI Scan coverage as automatic enforcement of secure software-delivery policy.

A mature pipeline may look like:

pull request
    |
    +--> CodeQL / deterministic analysis
    |
    +--> AI Scan / probabilistic detection
    |
    +--> dependency and secret checks
    |
    +--> human review
    |
    v
merge policy

The exact controls vary by repository. The important point is that AI detection can be one signal in the decision rather than the decision itself.

The cost question is still open

AI-assisted security analysis introduces a different resource model from traditional static analysis.

GitHub's public documentation and preview terms should be checked for the account's current licensing and usage behavior before a large rollout. The available independent reporting also notes that AI Scan is part of GitHub's AI-enabled security stack rather than a free replacement for conventional code scanning.

The Observatory will not infer a universal cost-per-repository or cost-per-finding from the feature announcement because the public material does not establish one stable workload price.

For operators, the measurable question is simpler: does the additional detection value justify the incremental AI usage and triage burden?

The security boundary has moved upward

The most interesting architectural consequence is that AI security detection is becoming a control-plane concern.

Previously, the question could be framed as:

Does this pull request get scanned?

The API makes another question possible:

What is our organization's effective AI security-scanning policy, and can we reproduce it automatically?

That distinction matters as developer platforms accumulate more autonomous features. GitHub already provides automated validation around third-party coding agents; AI Scan adds another model-assisted analysis stage; workflow protections and repository rulesets provide additional deterministic controls.

The platform is becoming a system for governing machine-generated changes, not merely storing source code.

What remains uncertain

The September releases establish feature availability and administrative behavior. They do not establish AI Scan's detection accuracy, false-positive rate, vulnerability-discovery rate, or superiority over CodeQL.

Those are empirical questions that require benchmark results and real deployment data.

The public preview also means behavior and eligibility can change. GitHub Enterprise Server support is explicitly absent from the cited releases, so availability should be rechecked before treating the feature as a general GitHub capability.

Finally, programmatic enablement does not prove that scans actually execute successfully in every eligible repository. Effective coverage should be measured from observed runs and findings, not only configuration state.

Why this matters

The September 2026 changes make AI Scan more interesting as infrastructure than as a headline feature.

GitHub has created a path from AI-assisted vulnerability detection → centralized policy → programmatic rollout → measurable fleet coverage. Removing the CodeQL default-setup prerequisite makes that path available to a broader set of repositories.

The durable observation is that AI security tooling is moving upward in the stack: the challenge is no longer only whether an AI detector can find a bug, but whether an organization can deploy, constrain, audit and measure that detector consistently across its software estate.

Sources and further reading

• GitHub Changelog — AI Scan no longer requires CodeQL default setup
• GitHub Changelog — AI Scan APIs in public preview
• GitHub Docs — AI-powered security detections
• TechTimes — GitHub AI Scan REST API coverage

Related Digital Observatory coverage: Google's agentic security workflow, GitHub Actions execution protections, and GitHub Copilot task-level agent efficiency.