Code scanning AI Scan no longer requires CodeQL default setup
GitHub's AI Scan for pull requests now operates independently of CodeQL default setup, expanding its ability to find security vulnerabilities across more repositories. Previously, AI Scan was limited to repositories with CodeQL configured, but this change removes that dependency, allowing for broader coverage. This functionality is now in public preview for GitHub Advanced Security customers on github.com for organization-owned and personal repositories. GitHub Enterprise Server is not supported for this release.
Enhancements (1) ›
- AI Scan's CodeQL default setup dependency removed
GitHub's AI Scan for pull requests can now detect security vulnerabilities even when CodeQL default setup is not enabled on a repository. This change broadens the applicability of AI Scan, which previously required CodeQL configuration. It is available in public preview for GitHub Advanced Security customers on github.com.
https://github.blog/changelog/2026-09-16-code-scanning-ai-scan-no-longer-requires-codeql-default-setup
Related releases
- Enterprise Admins Can Now Enforce GitHub Advanced Security Configurations GitHub Changelog ·
- GitHub Copilot suggests custom repository property definitions GitHub Changelog ·
- GitHub confirms SHA-1 in HTTPS sunset for github.com and Enterprise Cloud GitHub Changelog ·
- GitHub Profiles Now Show Highest Achievement Badge Tier GitHub Changelog ·
- GitHub Copilot adds tiers for cost and quality in auto model selection GitHub Changelog ·
- GitHub Copilot usage metrics now include VS Code Agents activity GitHub Changelog ·