The most dangerous vulnerability in an AI agent often isn't in the code at all — it's in the content the code reads. GitHub's answer, announced Wednesday, is a new code-scanning detector built specifically for AI applications and agents, now in public preview.
The headline risk it targets is indirect prompt injection, which GitHub notes is the top risk in the OWASP Top 10 for LLM applications. The attack is simple and hard to spot in review: malicious instructions hidden in untrusted content — a file, a webpage, an issue comment — that an agent reads, and then follows, because the agent also has access to tools, data, or business systems. The scanner traces those data flows and puts mitigation guidance directly in the pull request, according to GitHub. It also aims at two related failure modes: sensitive information disclosure and excessive agency, where an agent holds more permissions or autonomy than its task requires.
This matters because the trust boundary in software development has quietly moved. Agents now routinely read issues and act on repository content written by people who have no authority to instruct them. A traditional scanner checking for SQL injection won't see that problem; it's a data-flow problem, not a syntax problem. GitHub's detector is LLM-based rather than CodeQL-based, which is why it claims no language or framework limits.
But read the fine print before treating this as a safety net. According to GitHub's own documentation, in the public preview the detector only catches indirect prompt injection in AI agents; the other coverage arrives as it expands. Findings are advisory: they don't fail the code-scanning check and can't block a merge via rulesets. The scan is off by default, must be enabled separately from GitHub's existing AI Scan for pull requests, requires an Advanced Security license plus AI credits, and only looks at pull requests — not your backlog, forks, or Dependabot pull requests. It isn't available on GitHub Enterprise Server.
That makes the honest framing a review assistant, not a gate. A flagged prompt-injection path before merge is genuinely useful — these architectures are, as GitHub puts it, difficult to spot through manual review alone. But a clean scan proves nothing about runtime behavior, and the merge button still belongs to a human. For teams shipping agents with real tool access, the scanner is a reason to tighten least-privilege defaults now, not to relax them.
— via GitHub