# GitHub's new AI security detections on pull requests show software platforms now want to catch risky code inside the developer workflow itself instead of waiting for security review to happen later and elsewhere Source: TechNewsList (https://technewslist.com) Canonical URL: https://technewslist.com/en/article/github-ai-security-detections-prs-2026-07-15-morning Section: Software (https://technewslist.com/en/software) Author: TechNewsList Language: en Published: 2026-07-15T05:20:16.026+00:00 Updated: 2026-07-15T05:20:16.174198+00:00 > GitHub says code scanning can now surface AI-powered security detections directly on pull requests, extending vulnerability coverage beyond CodeQL-supported languages and moving more application security decisions into the moment before code merges. ## TL;DR - GitHub says code scanning now shows AI-powered security detections directly on pull requests. - The update expands vulnerability coverage to languages and frameworks not currently supported by CodeQL. - The larger software signal is that security is becoming a native part of code review rather than a downstream specialist checkpoint. ## Key points - GitHub is trying to make security findings appear where developers already review and merge code. - The update complements CodeQL instead of replacing deterministic analysis. - AI is being used to reduce blind spots across mixed-language repositories and unsupported frameworks. - Workflow placement matters as much as detection quality in secure software delivery. - Platform vendors increasingly want security, code review, and AI assistance to converge in one developer surface. # GitHub's new AI security detections on pull requests show software platforms now want to catch risky code inside the developer workflow itself instead of waiting for security review to happen later and elsewhere ## What happened GitHub says code scanning can now surface AI-powered security detections directly on pull requests. The company says the new detections expand vulnerability coverage to languages and frameworks not currently supported by CodeQL and appear as findings during the pull request process before code is merged. ![Contextual editorial image for GitHub's new AI security detections on pull requests show software platforms now want to catch risky code inside the developer workflow itself instead of waiting for security review to happen later and elsewhere GitHub code scanning CodeQL AI-powered security detections pull requests GitHub GitHub GitHub technology news](https://docs.github.com/assets/cb-68487/images/help/desktop/base-branch-selection.png) *Contextual visual selected for this TechPulse story.* That sounds like a straightforward product improvement, but the placement is the real story. GitHub is not merely adding another security feature to a dashboard. It is moving more of the security conversation into the exact surface where developers already review changes, discuss code, and decide whether something should ship. GitHub also says the findings generated through AI are labeled clearly as `AI`, and that the detections do not block pull-request merges by default. That suggests the company is trying to insert broader security coverage into developer flow without making the first version feel like an unpredictable policy hammer. ## Why it matters This matters because secure software delivery increasingly fails at the handoff points. Security tools may be powerful, but if findings arrive too late, in the wrong interface, or in a form developers treat as external bureaucracy, they lose practical value. GitHub's update tries to reduce that problem by shifting security left in the most literal sense: the findings now show up in the pull request itself. That is where a developer still has context, where reviewers are already looking, and where a vulnerability can become a code discussion instead of a delayed ticket. The other important point is coverage. Modern repositories are messy. They contain core application code, scripts, infra definitions, configuration, templates, and framework-specific logic that often stretches beyond the classic languages static analyzers cover well. GitHub is explicitly using AI here to close some of those gaps. ## Technical details GitHub's earlier explanation of AI-powered detections is useful context. The company has described the approach as a complement to CodeQL, not a replacement. CodeQL remains the deep deterministic analysis engine for supported languages, while AI-powered detections extend coverage into areas where traditional static analysis is harder to support quickly or comprehensively. ![Contextual editorial image for GitHub's new AI security detections on pull requests show software platforms now want to catch risky code inside the developer workflow itself instead of waiting for security review to happen later and elsewhere GitHub code scanning CodeQL AI-powered security detections pull requests GitHub GitHub GitHub technology news](https://teachbetter.ai/wp-content/uploads/2025/12/Top-15-Best-AI-Platforms-for-Teachers-Schools-in-2026.png) *Contextual visual selected for this TechPulse story.* That hybrid approach makes sense technically. Deterministic analysis is stronger when a language and rule set are mature. AI-based inference becomes more useful when repositories contain mixed ecosystems, edge patterns, or unsupported frameworks that would otherwise create blind spots. The pull-request integration matters just as much as the detection engine. If results appear directly in the workflow as the analysis returns them, developers can respond while changes are still small and reasoning is still fresh. That reduces the operational distance between finding and fix. GitHub's decision not to make AI detections merge-blocking by default is also revealing. It suggests the company understands that trust in AI-assisted security will be earned through workflow usefulness and signal quality before it can become a hard policy gate. ## Market / industry impact For the software market, this is another sign that developer platforms are converging. Code hosting, review, security, and AI assistance are increasingly being assembled into one continuous environment rather than treated as separate product categories. For security teams, the implication is potentially positive. More vulnerabilities can be caught earlier, closer to the people best positioned to fix them. But it also means security programs will need clearer policies around when AI-suggested findings are informational, when they become enforceable, and how they are audited. For GitHub, the move strengthens its platform argument. The more review, remediation, and security decisions happen natively inside GitHub surfaces, the harder it becomes for rival platforms or standalone tools to displace that workflow center of gravity. ## What to watch next Watch whether developers treat the new findings as useful review context or as extra noise. Adoption quality will depend heavily on precision and on how well teams can triage AI-labeled alerts. Watch also how GitHub evolves enforcement. If signal quality holds up, informational findings today could become rule-driven controls tomorrow. Most of all, watch competitors. If other code platforms and AppSec vendors push AI-backed findings directly into review workflows, that will confirm that the future of secure software delivery is not just better scanning. It is better timing, better placement, and tighter coupling between detection and developer action. ## Sources - [GitHub: AI security detections on pull requests](https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/) - [GitHub: expands application security coverage with AI-powered detections](https://github.blog/security/application-security/github-expands-application-security-coverage-with-ai-powered-detections/) - [GitHub: CodeQL 2.26.0 and AI prompt injection detection](https://github.blog/changelog/2026-07-10-codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection/) Mentions: GitHub, code scanning, CodeQL, AI-powered security detections, pull requests, application security ## Sources - [GitHub](https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/) - [GitHub](https://github.blog/security/application-security/github-expands-application-security-coverage-with-ai-powered-detections/) - [GitHub](https://github.blog/changelog/2026-07-10-codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection/)