Prompt injection is becoming a code finding. GitHub now flags agent code paths in pull requests

Prompt injection has mostly been treated as a model problem: something to filter at runtime, test with red teams and hope the next model resists. GitHub’s October 28 release treats it as something else, a defect with a location in your code.

Code scanning for AI applications, now in public preview on github.com, runs on pull requests next to CodeQL. It looks for agent code paths where untrusted content can reach a model that has access to tools, data or business systems, and reports them with mitigation guidance in the pull request. The first risk classes are indirect prompt injection, sensitive information disclosure and excessive agency.

The path, not the prompt

The useful idea is in what the scanner looks for. An injection only matters when three things meet in the same flow:

1. Untrusted content
2. Model call
3. Tools or data
4. Business effect

Each of those is visible in code. Which inputs are fetched, which ones are placed into a prompt, which tools the same call can invoke and with which credentials. A scanner can find that path the way it finds an SQL query built from user input. It cannot tell you whether a given model will obey a given injection, and it does not need to: if the path exists, the design is fragile.

That also tells you how to fix a finding. Remove the tool from calls that read untrusted content, split reading and acting into separate steps with a check between them, or reduce what the tool can reach. We described the same principle when eight fixes in the official MCP servers showed tools exceeding the access they were given.

Whole repositories, not only changes

The second release extends AI Scan, which we covered when it reached general availability for pull requests, to entire repositories in public preview. An agentic scanner explores the latest commit on the default branch, focuses on the code most likely to be vulnerable, covers languages and frameworks CodeQL does not, and skips issues CodeQL already reports. Each scan has a fixed time budget, which bounds its cost and means it is not exhaustive. Later scans report only new findings, and alerts do not close when a fix merges; you start another scan to close them.

This matters for the code that predates your AI review: the services written three years ago that an agent now calls. After Anthropic showed models chaining individually minor flaws, existing code is the part of the attack surface that grows more exposed without changing.

Requirements and limits

• AI applications scanning: public preview, github.com only, not GitHub Enterprise Server. Requires GitHub Advanced Security with code scanning and the new scanning enabled per repository. GitHub says coverage will expand; the release does not list supported languages or frameworks.
• AI Scan for repositories: public preview. Consumes Code Security AI credits, with budgets at the SKU level and a warning when exhausted. No Copilot license needed. Private repositories in organizations need Code Security or Advanced Security; private repositories owned by personal accounts are not supported.

A scanner that finds the injection path is a design review tool, not a guarantee. It will miss flows that cross services or happen through configuration. Use it to make the path visible in review, and keep the runtime controls (least-privilege tools, approval on consequential actions, logging) that hold when the scan misses.