September 11, 2026: GitHub announced a public preview of GitHub AI Scan APIs on September 10, giving teams a programmatic way to manage AI-powered security scanning on pull requests.
What changed
Teams can read and change enablement at two levels: /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan. This supports selective repository rollouts without configuring every repository through the interface. A repository cannot override an organization-level disabled setting.
The API preview is available on github.com for GitHub Advanced Security customers; GitHub Enterprise Server is excluded from this release. These details come from GitHub’s September 10 announcement.
Requirements and limits to understand
GitHub’s AI-powered security detection documentation says the preview requires both Advanced Security and Copilot licenses, and usage consumes AI credits. Enterprise permission, organization opt-in and CodeQL default setup are prerequisites.
The scanner supplements CodeQL coverage. Its findings appear on pull requests, not as repository backlog alerts. Findings are advisory: they do not block merges and cannot yet enforce merge requirements through rulesets. Full repository scans are unsupported, and false positives are possible.
Why this matters for QA engineers
The new controls make scan configuration a testable part of repository onboarding. Our recommendation is to pilot them on a small set of repositories before widening adoption.
Test policy precedence: verify that disabling scans at organization level prevents a repository setting from re-enabling them. Record both settings when investigating missing results.
Separate enablement from effectiveness: use controlled pull requests with known security issues and safe counterparts to assess useful findings and false positives. A successful settings update alone does not prove detection quality.
Keep release gates explicit: retain existing security and regression checks. Track AI findings, review effort and credit usage separately during the pilot so the team can judge whether the added signal justifies broader use.
Source information verified September 11, 2026. QA recommendations above are QATechTools analysis; the feature remains in public preview.