Brief
GitHub AI Scan for pull requests no longer requires CodeQL default setup
Code scanning's AI Scan can now be used on pull requests to find security vulnerabilities even when CodeQL default setup is not enabled on a repository.
GitHub's changelog states that AI Scan for pull requests can now find security vulnerabilities even when CodeQL default setup isn't enabled on a repository. Previously, the AI Scan pull request feature was tied to that setup.
The consequence: repositories that never enabled CodeQL default setup are no longer excluded from AI-based pull request scanning. The evidence does not say what configuration AI Scan requires instead, so the access path for those repositories is unspecified.
Practical step: on one repository without CodeQL default setup, turn on AI Scan for pull requests, open a pull request containing a known-vulnerable pattern, and record whether findings appear and whether they point to a specific line. That tells you whether this changes your review workflow.
Our reading
This matters to teams that deliberately skipped CodeQL default setup, whether for repository policy, monorepo layout or onboarding reasons, because a security scanning feature they could not use is now described as available to them. Anyone maintaining pull request review gates should care, since it adds a scan path that doesn't require adopting the default CodeQL configuration first. The evidenc…
What to do or watch
Test it on one repository that lacks CodeQL default setup and note what, if anything, you must configure before AI Scan produces findings. The unresolved question is what AI Scan requires in place of that setup.
Source details and supporting facts
Each line is stated by the page named above it.
Stated by GitHub
- You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn't enabled on a repository.
- The changelog is titled "Code scanning AI Scan no longer requires CodeQL default setup."
Sources
- GitHubText stored 16 September 2026
How this story was checked. Written from the 1 page listed above, stored 16 September 2026; claims checked against that stored text on 16 September 2026.
What that means
- 2 of 2 reported statements were confirmed against the page that carries them; the rest were removed rather than published.
- Figures in the text were required to appear in the stored source text: yes. Identifiers: yes.
- The check reads stored text only: no claim rests on a fresh look that did not happen.
- Where the reporting was silent, the text says so instead of filling the gap.