TORONTO, October 30, 2026 — GitHub can now catch a dangerous agent architecture before it ships. On October 28, GitHub announced that code scanning, in public preview, can detect vulnerabilities in AI applications and agents, including indirect prompt injection, sensitive information disclosure, and excessive agency. Scans run automatically when a pull request is created, alongside existing CodeQL analysis, and flag code paths where untrusted content can reach a model that has access to tools, data, or business systems, with mitigation guidance in the pull request itself.

That is a real advance, and it covers only half the problem. A pull request check inspects code. It does not inspect the live prompt an agent reads after deployment, the web page it fetches, the issue comment it processes, or the tool result returned in the middle of a task. Those arrive at runtime, after every scan has passed.

The scale of what agents read in the wild is now measured. Researchers Gabi Nakibly and Zvika Babo of Radware scanned 86 million GitHub items, including issues, pull requests, comments, and README files, and found prompt injections in approximately 2.5 of every 100,000 items examined. The hidden instructions fell into four categories: legitimate agent orchestration, restrictions on visiting bots, growth hacking, and malicious activity, including attempted exfiltration of sensitive data. Only the last category was malicious. The researchers document attempts, not confirmed compromises, and their scan concentrated on hidden text, so it cannot capture every form of prompt injection.

One hiding place shows why human review alone cannot close the gap. HTML comments in Markdown do not appear in the normal rendered page, so a reviewer sees an ordinary bug report while an agent processing the underlying Markdown encounters extra instructions. GitHub describes indirect prompt injection as the top risk in the OWASP Top 10 for LLM Applications: malicious instructions hidden in untrusted content that an AI agent reads, which can manipulate its behavior or trigger unintended actions when that agent also has access to tools, data, or business systems.

"Build-time scanning tells you the architecture can go wrong. It cannot tell you what the agent is about to read," said Sarah Reid, Securetron spokesperson. "Once an agent is live, every file, page, and comment it consumes is untrusted input arriving after the last scan. That traffic has to be inspected at the moment it flows, before it can drive a tool call or a data access."

AI-FW, Securetron's AI firewall and governance gateway, sits between AI agents and the models they call. Every prompt and response is scanned in real time for jailbreaks and prompt injection, with PII masking, toxicity filtering, and data-exfiltration blocking on every request, inbound and outbound. Agent identity is authenticated with API keys, JWT, mTLS, or Kerberos, roles are enforced with RBAC, and every transaction lands in a metadata-only audit log, with rolling risk scores and automatic blocking. The gateway is fail-closed by design and retains zero content.

The two controls are complements, not substitutes. GitHub's scanning, which requires a GitHub Advanced Security license and is not yet available on GitHub Enterprise Server, finds risky architectures before merge. Runtime inspection governs what a deployed agent actually consumes and does. Enterprises adopting agents need both, and they need the runtime half to be enterprise grade from the start.

The Community Edition of AI-FW includes enterprise-grade features with 10 billion tokens per rolling 30 days and no credit card required. For more information, visit https://aifw.io.

About Securetron: Securetron builds enterprise security infrastructure: AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends, and PKI Trust Manager with Boltron-AI for certificate lifecycle automation. For more information, visit https://aifw.io and https://securetron.net.

Press contact: Sarah Reid, Securetron, 1 Yonge St, Toronto, ON M5E 1E6, Canada, +1 (438) 927-8036, [email protected].