The Reviewer That Reads the Architecture: GitHub Code Scanning Flags AI Agent Risk at Pull Request Time
Manual review cannot see what only exists at runtime — an agent reading a poisoned issue comment, reaching a production tool, and acting on it. GitHub code scanning for AI applications, announced in public preview on 28 October 2026, moves that detection left: pull requests in repositories with GitHub Advanced Security are now automatically scanned alongside existing CodeQL analysis for indirect prompt injection (XPIA), sensitive information disclosure, and excessive agency, with more AI-specific checks promised as coverage expands. The detector flags agent code paths where untrusted content can reach a model that holds tool, data, or business-system access, and puts remediation guidance directly in the pull request before merge. It is the first time a major forge has productized the architectural reading of agent risk — not the model output, but the wiring around it.
Why the pull request is the right choke point
The timing is not accidental. Two days after this launch, Radware researchers presenting at [un]prompted II published a census of 2,281 real AI-directed findings and 47 outright attacks hidden in GitHub issues, comments, and README files — our 29 October briefing on exactly the threat class GitHub now scans for. The 222-technique planning-attack taxonomy published the same week shows the adversary side industrializing; and our Log-To-Leak briefing demonstrated exfiltration surviving to 100 percent success rates precisely because post-hoc logging never inspects the architecture. Scanning the wiring at merge time attacks the problem one layer earlier than all three: the dangerous pattern — untrusted input, capable agent, no boundary — is visible in the diff even when no single line looks wrong.
Convergence on scanning at build time
The notable signal is convergence. Anthropic’s Frontier Red Team, disclosing five working exploit chains built by an unreleased model, concluded that fixing the backlog only solves half the problem and recommended scanning at PR time — releasing a Claude Code plugin toward exactly that. GitHub’s detector now says the same thing from the platform side: risky agent architectures are difficult to spot through manual review alone, so the forge should spot them automatically. Two independent actors, one prescription, one week apart. That is how a practice becomes standard. The honest limits travel with it: public preview means incomplete coverage, the detector requires an Advanced Security license and does not run on GitHub Enterprise Server yet, and static findings at merge time are not runtime guards — a flagged-then-waived alert, an over-permissioned tool added after merge, or a prompt change with no code diff all sail past the scanner. PR-time detection shrinks the backlog’s growth rate; it does not watch the running agent.
What to do
- Enable scans for AI applications where Advanced Security already runs. The detector rides alongside CodeQL on pull requests — review new alerts on the Conversation or Files changed tab and remediate before merging.
- Treat excessive-agency findings as architecture bugs, not style nits. An agent with broader tool access than its task requires is the precondition nearly every October agent exploit chain needed.
- Keep runtime controls on the roadmap. Static PR scanning complements tool-level authorization, egress filtering, and post-hoc monitoring — it replaces none of them.
- Track coverage expansion before declaring the problem handled. Public preview detectors grow over time; re-audit previously merged agent code as new check classes ship.
Sources: