The News, Explained
GitHub announced on October 13, 2026 that organization and enterprise administrators can view operational results for AI Scan for pull requests in security overview. A pull request is the unit through which a proposed code change is reviewed before it is merged into a project. AI Scan analyzes those changes for potential security problems and can attach a suggested fix when one is available. The new view aggregates the rollout rather than requiring an administrator to inspect findings one pull request at a time. Source
Administrators can see how many findings AI Scan generated, how many were resolved and the remediation rate. The view also identifies repositories that produced findings, shows trends over a selected reporting period and reports how often developers applied autofix suggestions. It separates findings that include an autofix suggestion from those that do not. The announcement does not say that the dashboard measures false-positive rates, incident prevention or a severity breakdown, so these counts do not establish the security outcome by themselves. Source
GitHub is also changing the page structure. The former CodeQL pull requests page is renamed Code scanning on pull requests, with separate tabs for CodeQL and AI Scan. Existing CodeQL metrics move under the CodeQL tab. CodeQL is GitHub’s static-analysis approach for querying code structure and data flow, while AI Scan examines the context of pull-request changes with AI. Keeping the two result sets in separate tabs lets administrators compare activity over the same organization and period without treating the two scanning methods as one metric. Source
The feature is a public preview on github.com, including GitHub Enterprise Cloud. It is available to customers with GitHub Code Security or GitHub Advanced Security. GitHub Enterprise Server, the product installed on an organization’s own servers, is not supported in this release. Availability therefore depends on both the security product a customer has purchased and the way its GitHub environment is deployed. Source
OYOPICK’s Take
The useful question after adopting a security tool is not only how many warnings it produces, but how many reach resolution inside the development workflow. Pairing remediation rate with autofix acceptance gives organizations a starting point for distinguishing an AI scanner that adds alerts from one that helps changes get fixed. Repository-level differences can also prompt a closer look at review capacity or at code types where suggested fixes work poorly.
A high remediation rate is not the same as a high security level. Teams could close easy or low-impact findings quickly while consequential risks remain. Because the announcement does not specify severity, false-positive or recurrence metrics, administrators should not use remediation rate as a standalone performance target. It is more informative when paired with the age of serious unresolved findings and the reasons developers reject suggested fixes.
OYOPICK sees a constructive path if AI security tools move beyond counting detections and make the repair process more transparent. That outlook depends on GitHub adding severity and false-positive context after the preview, and on organizations using the dashboard to improve scan quality and support teams rather than turning it into a simplistic ranking table.