GitHub announced on 10 September 2026 that APIs for managing AI Scan for pull requests are in public preview. GitHub Advanced Security customers on github.com can read and update enablement at organisation and repository level, allowing security teams to automate a staged rollout across a portfolio. GitHub Enterprise Server is not supported in this release.
What happened: AI Scan enablement became programmable
The new organisation and repository endpoints report and update whether pull-request AI Scan is enabled. Organisation policy defines whether scans may run across the organisation, while repository settings control individual repositories. A repository cannot override an organisation-level disabled state.
GitHub's documentation says AI-powered detections complement CodeQL by examining pull requests in languages and frameworks that CodeQL does not cover. They run when CodeQL default setup is enabled and the feature is opted into, producing findings directly on the pull request without requiring a build system.
The feature remains a public preview. It requires GitHub Advanced Security and GitHub Copilot licences, consumes AI credits, and is available on github.com rather than GitHub Enterprise Server. The API and supported detection scope may change during the preview.
Why it matters: central rollout changes the governance problem
A manual toggle limits adoption but also slows uncontrolled expansion. Once enablement can be automated, a security team can reach hundreds of repositories quickly—and can just as quickly create unexpected review demand, cost or inconsistent coverage if it does not track the effective state.
AI-powered findings are advisory and cannot currently be used in rulesets to block a merge. They appear only on pull requests, not as full-repository backlog alerts, and may include false positives. Teams should therefore treat the feature as an additional review signal rather than evidence that a repository is comprehensively scanned or safe to release.
The value is strongest in coverage gaps such as PHP, Shell, Terraform, Dockerfiles and framework areas outside current CodeQL support. Even there, reviewers need ownership, response expectations and a way to distinguish useful detections from noise before broad rollout.
The practical implication: automate waves and measure effective coverage
Start with a repository inventory that records language, CodeQL default-setup status, licence eligibility, data sensitivity and accountable security owner. Enable a small representative cohort first, then use the read endpoints to reconcile requested state with effective organisation and repository policy.
Measure findings per pull request, confirmed vulnerabilities, false-positive feedback, time to triage, remediation acceptance, missed issues found elsewhere and AI-credit consumption. Compare those measures by language and repository risk so expansion is based on useful signal rather than raw alert volume.
Give the automation a narrowly scoped identity, log every enablement change and maintain an explicit opt-out path. Keep existing CodeQL, dependency, secret-scanning, peer-review and testing controls in place. Before expanding a wave, confirm developers understand that an empty AI Scan result is not a security approval and that findings do not currently enforce a merge gate.
Key takeaways
Roll out AI Scan through measured repository cohorts, not an organisation-wide enablement without evidence.
Reconcile organisation policy, repository state, CodeQL setup and licence eligibility so dashboards show effective coverage rather than intended coverage.
Track confirmed findings, false positives, review time and AI-credit use together, while preserving established application-security controls.
Sources
This article is original analysis written by IT Web Builder. The reporting and product details below were used as references and are credited to their publishers.
GitHub Changelog — AI Scan for pull request APIs in public previewPublished 10 September 2026. Primary announcement for organisation and repository API management, policy inheritance, eligibility and platform availability.↗GitHub Documentation — AI-powered security detections in pull requestsOfficial reference for operation, licences, AI-credit use, supported coverage, advisory status, limitations and enablement hierarchy.↗GitHub REST API — Code scanning endpointsOfficial endpoint and permission reference. Product facts are attributed to GitHub; rollout and measurement recommendations are IT Web Builder Editorial analysis.↗IT Web Builder publishes original summaries and practical commentary. We do not reproduce source articles. Product claims and announcements are linked to their original publishers so readers can verify the details.