Code scanning for AI applications in public preview

Code scanning can now detect AI applications and agent vulnerabilities, including indirect prompt injection (XPIA), sensitive information disclosure, excessive agency, and other AI-specific risks as coverage expands. Scans automatically run on pull requests.

Here’s an overview of AI applications and agent vulnerabilities that are covered:

• Indirect prompt injection is the top risk in the OWASP Top 10 for LLM Applications. It happens when malicious instructions are hidden in untrusted content (e.g., a file, webpage, or issue comment) that an AI agent reads. If that agent also has access to tools, data, or business systems, those hidden instructions can manipulate its behavior or trigger unintended actions. As more teams build agents into their codebases, these risky architectures can be difficult to spot through manual review alone.
• Sensitive information disclosure happens when an AI application or agent can access sensitive data without appropriate authorization controls, potentially exposing it to users or systems that should not have access.
• Excessive agency happens when an AI agent has more capabilities, permissions, or autonomy than its task requires, increasing the risk of unintended or high-impact actions.

Code scanning for AI applications:

• Scans pull requests automatically when they’re created, alongside your existing CodeQL analysis.
• Flags agent code paths where untrusted content can reach a model that has access to tools, data, or business systems.
• Provides actionable mitigation guidance directly in the pull request so you can address the risk before it ships.

If your organization uses GitHub Advanced Security, this detector starts scanning pull requests in repositories where code scanning and scans for AI applications are enabled. Review any new alerts on the Conversation or Files changed tab of your pull requests, and use the provided guidance to remediate before merging.

Code scanning for AI applications is now in public preview on github.com and requires a GitHub Advanced Security license. It isn’t available on GitHub Enterprise Server at this time.

Learn more about AI applications code scanning on pull requests and join the discussion in GitHub Community.