GitHub's AI Scan can now scan a whole repository with an agentic code scanner, cover languages CodeQL does not support, and skip issues CodeQL already found
AspireAI community · GitHub Changelog
GitHub put AI Scan for repositories into public preview, extending its agentic code scanner from pull request changes to the whole repository. An agentic scanner explores the repository and focuses on the code most likely to contain vulnerabilities, each scan runs within a fixed time budget to keep the cost bounded, and findings land in the same code scanning alert list as CodeQL alerts, with assignees, linked pull requests and security campaigns.
The practical scope is broader than the previous pull-request-only version. It covers languages and frameworks CodeQL does not support and finds issues rule-based analysis misses in languages CodeQL already covers, and when both scanners run on the same repository AI Scan skips issues CodeQL already reports. On rescans it keeps existing findings open when it detects them again and reports only new ones. AI Scan alerts do not close automatically when you merge a fix, so you start a new scan to close what you have fixed.
Availability is narrower than the headline in one direction and wider in another. It works on github.com and GitHub Enterprise Cloud with data residency and needs no GitHub Copilot license, but for organization-owned repositories the private and internal cases require GitHub Code Security or GitHub Advanced Security, and private repositories owned by personal accounts are not supported. Usage consumes Code Security AI credits, which can be capped at SKU level, and GitHub tells you before a scan starts if the budget is already spent.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.