GitHub makes AI Scan and agentic alert remediation generally available
Two separate code-security changes reach general availability on the same day.
General availability
Facts, analysis and limits
Verified facts
- AI Scan complements CodeQL in pull requests with additional languages and formats, including PHP, Bash, Terraform and Dockerfile.
- Its alerts are advisory and do not block merges; the feature does not cover pull requests from forks or Dependabot.
- Agentic autofix explores the repository, proposes a fix, reruns CodeQL and opens a draft pull request; it can group up to 25 alerts from the default branch.
- AI Scan consumes Code Security AI Credits; agentic autofix also consumes GitHub Actions minutes and requires the appropriate administrator policies.
What changes
AI detection and remediation become more deeply integrated into the security pipeline.
Practical implication
Enable on a pilot repository, set a budget, and keep a human review of patches.
Availability
Belgium/EEA: regional scope is not specified in the sources reviewed; check the account, contract and processing region before use.
Limits and uncertainty
No independent product testing or account-access check was performed for this entry.