Security Tooling Is Finally Moving Into the AI Code Loop

The important change in AI-code security is placement. The first generation of tools waited for a pull request, produced another alert, and hoped a developer had time to interpret it. The recent releases move checks into the agent’s edit loop, add probabilistic detection alongside deterministic analysis, and hand remediation work to agents—but they also introduce new credit meters, previews, and plenty of reasons not to auto-merge the result.

GitHub now validates code from third-party coding agents by default

GitHub made security validation generally available for third-party agents working inside repositories, explicitly including Claude and OpenAI Codex. When those agents change code, GitHub can run CodeQL, check new dependencies against the GitHub Advisory Database, and scan for secrets; the agent is then given a chance to resolve findings before it finalizes its pull request. The validation follows the repository’s existing Copilot settings and does not require a GitHub Advanced Security license.

Why it matters: if your team permits several agents rather than standardizing on Copilot, this is a practical baseline that travels with the repository instead of becoming a different local setup for every CLI and editor. It is still validation, not a security guarantee: it only sees what the configured analyzers cover, and the eventual PR still deserves normal review.

GitHub added AI security findings to pull requests

GitHub Code Security now has AI-powered detections in public preview that appear directly on pull requests and aim to cover languages and frameworks outside CodeQL’s native analysis. The results are labeled AI, run when a PR opens or updates, and arrive as the detection engine returns them rather than waiting for every analysis source to finish. They are informational, so they do not block a merge.

Why it matters: this is the sensible place to test AI-assisted detection—beside the diff and distinguishable from conventional CodeQL alerts—not in a separate dashboard. The trade-off is operational: it requires GitHub Code Security, CodeQL default setup, enterprise approval, and a Copilot license; preview runs also consume AI credits, so turn it on for representative repositories before rolling it across every noisy monorepo.

GitHub’s autofix has become a codebase-exploring agent

GitHub put agentic autofix for code-scanning alerts into public preview. Assign an alert to Copilot and it explores relevant files, proposes a change, reruns CodeQL to check whether the alert closes, iterates if necessary, and opens a draft pull request. It works for CodeQL and third-party scanner alerts; GitHub says a run typically takes two to four minutes.

Why it matters: this is more useful than a one-file patch when a real remediation spans validation, callers, and tests—and it gives back a reviewable draft instead of silently editing main. Treat it as backlog acceleration, not autonomous remediation: it requires both Code Security or Advanced Security and Copilot cloud agent access, consumes AI credits and Actions minutes, and validation that closes one alert does not establish that the behavioral change is correct.

Semgrep Guardian moves policy checks before the pull request

Semgrep launched Guardian as an agent-facing package of an MCP server, hooks, and skills for scanning generated code as it is written. It is designed to run against code, dependency, and secret policies in agents and IDEs including Claude Code, Cursor, Codex, Copilot, Windsurf, and Replit. Semgrep says Guardian performs more than three million scans per week across its customers, with 95% finishing in under five seconds.

Why it matters: deterministic hooks are a better control than asking an agent to remember a security prompt, especially when it is editing ten files in a loop. But fast inline scanning only helps where your rules and package intelligence have coverage; it will not settle authorization or product-specific abuse cases by itself, so use the hook as an early gate and keep CI plus targeted review as the backstop.

Semgrep is also selling agentic vulnerability hunting, not just linting

Semgrep’s new Agentic Workflows public beta ships nine prebuilt workflows covering more than 70 CWEs. The workflows combine Semgrep’s taint and interfile analysis with frontier-model reasoning to hunt for SQL injection, XSS, SSRF, command and NoSQL injection, weak crypto usage, and broader web, API, and crypto flaws; they run on a customer’s existing pool of AI credits.

Why it matters: the interesting target is the class of issue ordinary pattern matching misses—authorization mistakes and exploitability that depend on codebase context. This is not a reason to accept vendor precision claims untested: it is a public beta, model-assisted analysis can still create expensive triage, and the first rollout should be a bounded comparison against known findings or a manually reviewed high-risk service, not an organization-wide flood of new tickets.