GitHub adds prompt-injection scans for AI agents—with limits
GitHub's new public preview examines dangerous data flows in AI applications. The official technical documentation, however, sets an important boundary on what the detector can actually find today.
GitHub discusses prompt injection, information disclosure and excessive agency as risk categories. Its current public-preview detector identifies indirect prompt-injection vulnerabilities only. Findings are advisory and do not automatically block a merge.
Sources and evidentiary limits
- Primary sources
The dated GitHub announcement and its current feature documentation establish different scope claims. Announcement · Actual preview limits
- No independent benchmark
No independent scanner test, invented detection rate, or compliance certification.
What GitHub released on October 28
On October 28, 2026, GitHub introduced code scanning for AI applications and agents in public preview. Its purpose is to identify risky data flows in which untrusted material reaches a language model that also has access to tools, business systems or sensitive information. Findings appear during pull-request review.
That matters because a traditional scanner may see perfectly valid code while an agent still acts on malicious instructions hidden inside a document or webpage. Agent security depends on the relationship between outside input, model behavior and available tool privileges.
The preview detects less than the announcement suggests
GitHub's launch describes indirect prompt injection, sensitive information disclosure and excessive agency as important agent risks. Yet its detailed documentation expressly states: during public preview, AI applications scanning only detects indirect prompt-injection vulnerabilities.
That narrower implementation statement should determine adoption decisions. The other categories describe the broader problem space, not verified current preview coverage. Teams cannot reasonably claim that all data exposure or overprivileged-agent paths have been checked simply because this scanner is enabled.
How an indirect prompt injection becomes dangerous
Consider a support agent that reads customer documents and can also update internal tickets. An attacker embeds instructions in an uploaded file telling the agent to send sensitive records elsewhere. If the model treats that untrusted content as an instruction and has sufficient tool access, a document can redirect an otherwise legitimate workflow.
The new detector seeks code paths carrying untrusted data to models with tools or data access. An alert is evidence of a potentially risky pattern, not proof that a particular exploit has succeeded. Real impact still depends on runtime permissions, authentication, tool boundaries and other defenses.
Pull-request scans do not cover the entire repository
GitHub says the detector runs on newly opened pull requests and subsequent commits. The preview does not scan an entire historic repository backlog. Documentation also excludes pull requests from forks and those created by Dependabot. Teams with several contribution paths should carefully document which changes are actually covered.
Already deployed agents require additional assessments: manual code review, threat models, runtime logs and tests with malicious input. A green new pull request does not establish that the deployed system's existing agent permissions are appropriate.
Alerts are advisory, not merge-blocking controls
According to GitHub, findings are advisory and cannot currently be used in rulesets to enforce a merge requirement. Copilot Autofix may suggest a patch for a finding, but the generated code still requires technical review and validation against the actual exploit path.
Organizations therefore need a clear response policy. Who owns the warning? When should a release be paused? What shows that a proposed fix is effective? The absence of an alert must never be presented as proof that no prompt-injection risk exists.
Availability, credits and product boundaries
The current public preview is documented for GitHub Enterprise Cloud with GitHub Advanced Security, including the data-residency option. It is disabled by default until the required enterprise and organization policies are enabled. Usage also consumes AI credits. GitHub Enterprise Server is not supported.
This detector is distinct from CodeQL and GitHub's general-purpose AI Scan. Enabling the latter does not automatically enable AI applications scanning. GitHub documents the different products and their scopes separately, which matters for both coverage claims and budgets.
How to evaluate it without overclaiming
A small pilot can compare an intentionally vulnerable data flow with a guarded version where tool permissions are checked independently. Record detected and missed cases, false positives, review time, AI-credit consumption and whether any proposed fix actually closes the attack path.
The preview may be a valuable early-warning layer in pull requests. It is not an agent-security certificate. As of October 31, 2026, the documented scope remains indirect prompt injection, advisory alerts and restricted deployment eligibility. AgentenCode has not independently benchmarked detection rates. Read our agent security reference for additional context.
Primary sources
- GitHub Changelog · Code scanning for AI applications, 28 October 2026
- GitHub Docs · AI applications scanning for pull requests
- GitHub Docs · About AI Scan, three distinct scanners
Cutoff October 31, 2026. No independent product security audit.
Frequently asked questions
Does it detect every AI-agent security vulnerability?
No. Current GitHub documentation restricts public-preview detection to indirect prompt injection. The launch also discusses broader risk classes.
Can an alert automatically block a pull request merge?
No. Findings are advisory and cannot currently be enforced through merge-blocking rulesets.
Is the scanner available free on every GitHub plan?
No. It requires GitHub Advanced Security on Enterprise Cloud, policy enablement and AI credits.