# GitHub AI Scan no longer needs CodeQL default setup GitHub has removed a setup dependency from its AI-powered pull-request security scanning: repositories can now use AI Scan without first enabling CodeQL default setup, widening the feature beyond repositories already configured around CodeQL’s standard analysis pipeline. The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations. - Status: Active - Published: 2026-09-17T06:24:58+12:00 - Updated: 2026-09-17T06:24:58+12:00 - Categories: Artificial Intelligence, Web Development, AI Coding, Developer Tools - Tags: AI coding, cybersecurity, GitHub, security - Canonical HTML: https://beyondthe.news/dossiers/github-ai-scan-codeql-default-setup-requirement-removed ## What changed GitHub announced on September 16, 2026 that AI Scan no longer requires CodeQL default setup. When GitHub introduced AI-powered security detections on pull requests in July, the feature required GitHub Code Security and CodeQL default setup. The new rollout removes that specific CodeQL configuration dependency, allowing eligible repositories to enable the AI scanning path without first adopting default setup. ## Why it matters Security features often fail to spread because the prerequisite architecture is more invasive than the feature itself. Removing CodeQL default setup as a hard dependency lowers the integration cost for repositories that use advanced CodeQL configuration, another scanning workflow or simply have not adopted default setup. It also separates GitHub’s AI-assisted vulnerability detection more clearly from one particular static-analysis configuration, although eligibility, licensing and the AI scanner’s own detection quality remain separate questions. ## The July rollout had a concrete CodeQL prerequisite GitHub’s original AI security detections on pull requests were tied to GitHub Code Security with CodeQL default setup enabled. That meant the AI layer was not simply an independent switch for every repository already using GitHub. ## September removes the default-setup dependency GitHub now says AI Scan can operate without CodeQL default setup. Repositories that deliberately use a different CodeQL configuration path no longer need to restructure that setup merely to access the AI scan. ## This changes adoption more than scanner capability The material change is packaging and integration. GitHub is not claiming a new model or a new vulnerability class in this announcement; it is removing a prerequisite that constrained where the existing AI-powered scan could be used. ## AI Scan still belongs in a layered security workflow An AI scanner can surface additional findings, but it does not replace deterministic analysis, secret scanning, dependency review or human security review. Teams should compare false positives, missed issues and remediation usefulness against their existing pipeline before making it a required merge gate. ## Key details - GitHub announced the prerequisite change on September 16, 2026. - AI Scan no longer requires CodeQL default setup. - GitHub’s July 14 rollout of AI-powered security detections had required GitHub Code Security and CodeQL default setup. - The change lowers configuration coupling rather than introducing a new scanning model. - Existing GitHub repository security controls such as secret scanning and rulesets remain separate mechanisms. ## Builder takeaways - If you skipped AI Scan because your repository does not use CodeQL default setup, re-evaluate the feature against your current code-scanning configuration. - Do not switch from a carefully tuned advanced CodeQL configuration merely to obtain AI Scan; the new rollout removes that reason. - Measure AI Scan findings separately from deterministic CodeQL findings so you can evaluate false-positive and incremental-detection value. - Keep merge policy explicit: enabling an AI scanner does not automatically mean every AI finding should become a hard merge blocker. ## What to watch - Whether GitHub broadens AI Scan eligibility or licensing beyond the current Code Security boundary. - Independent measurements of incremental vulnerability detection versus CodeQL alone. - Whether AI Scan gains organization/enterprise policy and API controls for fleet-wide rollout. - Whether GitHub exposes clearer provenance explaining which findings came from AI Scan versus deterministic queries. - Any move from optional pull-request findings toward enforceable ruleset integration. ## Uncertainties - GitHub’s September announcement is primarily a setup/availability change and does not provide new independent accuracy data for AI Scan. - Removing CodeQL default setup does not mean all repositories or plans necessarily receive the feature. - The operational value depends on how much AI Scan adds beyond a team’s existing static-analysis and review workflow. ## Sources - [Code scanning: AI Scan no longer requires CodeQL default setup](https://github.blog/changelog/2026-09-16-code-scanning-ai-scan-no-longer-requires-codeql-default-setup/) — GitHub · primary changelog · 2026-09-16T00:00:00+12:00. Primary source for removal of the CodeQL default-setup prerequisite. - [Code scanning shows AI security detections on pull requests](https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/) — GitHub · primary background · 2026-07-14T00:00:00+12:00. Original rollout establishing the earlier GitHub Code Security and CodeQL default-setup requirement.