What happened
On Oct 15, GitHub announced GA of AI Scan for pull requests in code scanning: an AI-powered detector that finds vulnerabilities in PR changes for languages/frameworks CodeQL does not cover (PHP, Shell/Bash, Terraform/HCL, Dockerfiles, JSP, Blazor/C#). Findings appear alongside CodeQL with an 'AI' indicator, can include risk explanation and suggested autofix, and consume Code Security AI Credits; available for public repos at no extra cost, private repos via Code Security/Advanced Security.
Why it matters
This is a GA security capability from a foundational code platform that closes a real coverage gap for AI-era appsec (non-CodeQL languages) with autofix suggestions, at near-zero friction since it rides existing code-scanning workflows. It strengthens GitHub's AI-native defense-in-depth position already expanding via AI secret detection (ModernBERT) against AI-generated code volume.
Applicability
GitHub Advanced Security/Code Security customers and open-source orgs should enable AI Scan for PRs to cover languages CodeQL misses; security and DevEx teams evaluating AI code-scanning should trial it on PHP/Shell/Terraform/Docker repos.