GitHub's AI Scan now runs without CodeQL default setup
AI-native security scanning just got easier to turn on across your repos — still preview and GHAS-only, and self-hosted Enterprise Server is left out.
Copy markdown
What actually changed
AI Scan — GitHub's LLM-based vulnerability check for pull requests — used to run only on repos that had CodeQL default setup enabled. As of Sept 16 it runs on its own, across all your eligible repos, with no new setup step if code scanning is already on. It's still public preview and GitHub Advanced Security only.
Flip it on across a whole org via API
Two REST endpoints (shipped Sept 10) let you enable or disable AI Scan org-wide or per repo, and a repo can't override an org-level 'off'. The sane rollout: turn it on for your highest-risk repos first — customer-facing APIs, anything touching PII or payments — then widen, no per-repo clicking.
The reported catch: it may meter your Copilot credits
Deterministic CodeQL scanning is bundled into your GHAS license; AI Scan reportedly draws on Copilot's usage-based AI credits instead. GitHub's own preview notes don't spell out pricing, so before you flip the org-wide switch, watch what more repos-in-scope does to your monthly bill.
Budget requests land the same week
GitHub also made Copilot budget-increase requests generally available on Sept 16 — so if your org burns through its AI spend cap, an admin can request more from the console instead of filing a support ticket. Handy timing for a feature that eats credits.
Self-hosted? Still shut out
GitHub Enterprise Server isn't supported — not for AI Scan and not for the new API. If you're on-prem or air-gapped for data-residency reasons (finance, health, gov), rules-based CodeQL stays your only GitHub-native scanner for now, with no roadmap date given.
Elsewhere: lock down who can mint your OpenAI keys
OpenAI added key-governance controls (Sept 15): an org can restrict new API keys to service-account keys only, to user-owned project keys only, or block new keys entirely — and keys can now carry expiration dates. Worth five minutes if stray personal keys keep hitting your org quota.