GitHub's AI can now find, fix and retest vulnerabilities. It still cannot block a merge or approve one
AI Scan and Agentic Autofix reached general availability on October 15. One advises, the other opens draft pull requests. Read the limits as design: the pull request stays the control boundary.
Listen to this article · 5 min
AI-generated narration of the full article.
On October 15 GitHub moved two AI security features to general availability on the same day, and both arrive with a deliberate limit. AI Scan finds vulnerabilities in pull requests, and its findings cannot block a merge. Agentic Autofix investigates and fixes alerts, and it can only open a draft pull request. The limits are the most useful part of the release, because they show where GitHub thinks AI judgment ends and enforcement begins.
Two features, two jobs
AI Scan uses a model to look for vulnerabilities in pull request changes, aimed at code CodeQL does not cover today: PHP, Shell and Bash, Terraform HCL, Dockerfiles, JSP and Blazor, among others. Findings show up next to CodeQL results, marked with an “AI” indicator, and can include an explanation and a suggested fix. It runs automatically when code scanning and the repository’s AI Scan setting are enabled. Public repositories get it; private and internal repositories need GitHub Code Security or Advanced Security. No Copilot license is required. It does not run on pull requests from forks or from Dependabot.
Agentic Autofix works on alerts that already exist. Assign a code scanning alert on the default branch to Copilot, or select up to 25 alerts to fix in one pull request, or set the assignee through the REST API. Copilot explores the relevant files, proposes a fix, reruns CodeQL to confirm the alert closes, iterates if needed, and opens a draft pull request with a summary and the validation steps it took. It is available to Code Security and Advanced Security customers on GitHub Enterprise Cloud, including data residency, once an enterprise administrator enables the policy and a Copilot billing method exists. Alerts found only on other branches or on pull requests cannot be assigned.
| Changes code? | Can block a merge? | Checked by | |
|---|---|---|---|
| CodeQL | No | Yes, through rulesets | Deterministic rules |
| AI Scan | Suggests a fix | No, advisory only | A person reading the finding |
| Agentic Autofix | Yes, in a draft pull request | No, it is the author | CodeQL rerun, then human review |
Why an AI finding should not block a merge
A merge gate has to be predictable. Developers need to know why a check failed, reproduce it and fix it; security teams need to know the gate behaves the same way tomorrow. A model’s findings are probabilistic, and they shift with the model. Letting them block merges would make delivery depend on variance nobody can audit. GitHub’s choice to keep AI Scan advisory is the correct one, and teams should resist the temptation to rebuild a blocking gate on top of it with custom automation.
That makes AI Scan a triage input. Its value is measured by whether developers act on its findings, which is why GitHub’s AI Scan metrics, announced two days earlier, matter more now that the feature is GA: remediation rate and autofix acceptance per repository, split by severity, are how you decide where it earns attention.
Why a passing rerun is not an approval
Autofix’s validation step is real progress: the agent checks its own fix against the same CodeQL query that raised the alert. But it proves one thing, that this alert no longer fires. It does not prove that the change preserves behavior, does not introduce a different weakness, or matches how the owning team would have fixed it. A batch of 25 alerts in one pull request makes that review harder, not easier.
So the draft pull request is the control boundary, and the reviewer is doing a code review of an agent-authored change. Treat it like any change from a new contributor: tests must pass, an owner who knows the code approves, and the author and the approver are different identities. That is the change-management frame we apply to agent authors, and here it comes built in.
Budget the labor on both sides
Both features consume Code Security AI Credits, and Autofix also consumes GitHub Actions minutes. GitHub lets enterprises set SKU-level budgets for those credits; set them before enabling the policy, not after the first invoice.
The less visible cost is reviewer time. If Autofix turns a backlog of 2,000 alerts into 80 pull requests, someone has to review 80 pull requests. A sensible rollout starts with one alert class that has a well-understood fix pattern, measures how often draft fixes merge without rework, and expands by class from there. Google’s experience with security agents in code review points the same way: these tools earn their place inside the workflow where people already decide, and that place is still the pull request.