Skip to content
NewsProduct launch

GitHub code scanning now flags prompt injection and excessive agency in pull requests

· by Pondero Newsdesk

The short version

GitHub's code scanning can now catch indirect prompt injection, sensitive data exposure, and excessive agency in AI agent code before a pull request merges, running automatically alongside CodeQL.

GitHub code scanning now flags prompt injection and excessive agency in pull requests

GitHub's code scanning can now catch the exact pattern that turns a helpful AI agent into an attacker's foothold: an agent reading untrusted text, like a webpage or an issue comment, that secretly contains instructions the agent then obeys. As of October 28, per GitHub's changelog, that detection, called indirect prompt injection, runs automatically on every pull request alongside the existing CodeQL analysis, with no extra setup for repositories that already have code scanning enabled.

What shipped

The new detector covers three risk categories. Indirect prompt injection flags agent code paths where content from a file, webpage, or issue comment can reach a model that also has access to tools, data, or business systems, the architecture GitHub's post calls the top entry in the OWASP Top 10 for LLM Applications. Sensitive information disclosure flags agents that can reach sensitive data without authorization controls. Excessive agency flags agents granted more permissions or autonomy than their stated task needs. Each finding surfaces in the pull request's Conversation or Files changed tab with mitigation guidance attached, so a reviewer gets a fix suggestion before merging rather than a postmortem after a breach. The feature is in public preview on github.com now, requires a GitHub Advanced Security license, and does not yet work on GitHub Enterprise Server.

Advanced Security customers get agent-risk review for free, if they already pay for the license

This is not GitHub's first AI-specific security move of the year. The company put programmatic controls for a related capability, AI Scan for pull requests, into public preview back in September, letting organizations enable AI-powered detections across repositories via API rather than clicking through settings one repo at a time. October's release builds on that same scanning infrastructure but targets a different failure mode: not bugs in ordinary code, but agent architectures where an attacker never touches a credential at all, they just leave a malicious instruction somewhere the agent will read it. For any team shipping an internal agent that ingests outside content, the practical move is to turn this on now rather than wait for an incident to force the question, since the check runs for free on top of a license many enterprise teams already carry.

What to watch next

GitHub has not said when the detector reaches GitHub Enterprise Server or when it exits preview, and the changelog post frames the three covered categories as a starting set that will expand over time. The open question for security teams is false-positive rate at scale: a detector that flags every agent touching external content risks reviewer fatigue if it cannot distinguish a genuinely risky tool-and-data combination from a benign one.

Sources