cyber.hendryadrian.com
Security News · bleepingcomputer.com

GitHub Adds AI-Based Scanning to Code Security

· Original article ↗

Summary

GitHub plans to add AI-based scanning to Code Security, supplementing CodeQL to cover more languages and frameworks. Public preview is expected in early Q2 2026; GitHub also reports internal testing and Copilot Autofix results.

Key points

  • AI detections will supplement CodeQL, which GitHub says will continue providing deep semantic analysis for supported languages.
  • The expanded coverage is expected to include Shell/Bash, Dockerfiles, Terraform, PHP, and other ecosystems.
  • GitHub expects the hybrid scanning model to enter public preview in early Q2 2026.
  • GitHub says internal testing processed more than 170,000 findings in 30 days, with 80% positive developer feedback.
  • GitHub reports that Copilot Autofix users resolved security alerts in an average of 0.66 hours, compared with 1.29 hours without Autofix.

Article Details

Event Type
GitHub announced AI-based vulnerability detection for Code Security, complementing CodeQL in a hybrid scanning model. Public preview is expected in early Q2 2026.
Impact
The system is intended to broaden code-scanning coverage to Shell/Bash, Dockerfiles, Terraform, PHP, and other ecosystems, with findings surfaced in pull requests alongside Copilot Autofix suggestions. GitHub reported that internal testing processed more than 170,000 findings in 30 days with 80% positive developer feedback. For 2025, GitHub reported average resolution times of 0.66 hours with Copilot Autofix versus 1.29 hours without it.

Vendors

GitHubGitHub is adopting AI-based scanning in its Code Security tool to complement CodeQL and expand vulnerability detection across additional languages and frameworks.

Products

CodeQLGitHub is adopting AI-based scanning in its Code Security tool to complement CodeQL and expand vulnerability detection across additional languages and frameworks.Copilot Autofixwith public preview expected in early Q2 2026 and findings integrated into pull requests alongside Copilot Autofix suggestions.GitHub Advanced SecurityHowever, paying users can access the full set of features for private/internal repositories as part of the GitHub Advanced Security (GHAS) add-on suite.GitHub Code SecurityGitHub Code Security is a set of application security tools integrated directly into GitHub repositories and workflows.

Related Articles