On October 28, 2026, GitHub put code scanning for AI applications into public preview. And it changes what a pull request review means when an agent is in the loop. The new detector flags indirect prompt injection, sensitive information disclosure. And excessive agency directly in pull requests, runs when a