AI & Tech Brief — 17 September 2026: AI Scanning, Copilot Budgets and Repository Governance

Overview

Edition: 17 September 2026 (Japan Standard Time). Three GitHub updates announced on 15–16 September focus on where AI-assisted development meets security, spending controls, and repository governance. These are vendor announcements, not claims that every team has adopted or enabled the features.

Key takeaways

  • AI Scan for pull requests no longer depends on CodeQL default setup, but the relevant scanning features still need to be enabled.
  • Copilot Business and Enterprise members can request a budget increase when they exhaust their AI credits; a paying account's manager decides whether to approve it.
  • Copilot can suggest allowed values while administrators define repository custom properties in a public preview.

Top stories

1. AI Scan removes a CodeQL setup dependency

Announced: 16 September 2026. GitHub says AI Scan for pull requests can find security vulnerabilities even where CodeQL default setup is not configured. Code scanning and AI Scan for pull requests must still be enabled at the applicable repository, organization, or enterprise level. The change is a public preview on github.com for GitHub Advanced Security customers, including organization-owned and personal repositories; GitHub Enterprise Server is not supported in this release. Teams should check their actual enablement and coverage rather than assuming all pull requests are scanned.

Primary source: GitHub Changelog

2. Copilot adds a budget-increase request workflow

Announced: 16 September 2026. Members who use all their Copilot AI credits can now request more budget from the account that pays for it. Organization owners, enterprise owners, and billing managers can review requests, set an amount, and approve, adjust, or deny them in settings. Approval raises the member's budget and restores access to credit-consuming features. GitHub says this is generally available for Copilot Business and Enterprise under usage-based billing. A request itself does not authorize spending; managers should review cost implications before changing a budget.

Primary source: GitHub Changelog

3. Copilot suggests repository custom-property values

Announced: 15 September 2026. When an administrator creates a custom property definition at the organization or enterprise level, Copilot can suggest allowed values based on the property's name. GitHub gives compliance and internet-facing classifications as examples. Owners can control availability through a policy for repository custom-property suggestions. The feature is in public preview for Copilot Business and Enterprise. Administrators still need to choose values that fit their governance rules; a suggestion is not an approved classification.

Primary source: GitHub Changelog

Watchlist

  • Security coverage: Verify which repositories and pull requests actually receive AI Scan during the preview.
  • Budget governance: Monitor requests and approval amounts without treating a notification as permission to spend.
  • Repository metadata: Review suggested property values for consistent meaning before using them in rulesets.

The product details above are attributed to GitHub's linked announcements. The checks in this watchlist are editorial analysis and do not assert measured outcomes.

コメント

コメントを投稿

このブログの人気の投稿

Faber：コードグラフ活用のコスト効率良いオープンソースAIコーディングエージェント

Show HNで紹介された「Faber」は、コードグラフを活用したコスト効率の高いオープンソースのコーディングエージェントです。リポジトリの構造をグラフとして扱うことで、エージェントの動作を効率化し、トークン消費やツール呼び出しを削減することを目指しています。 このようなツールは、個人開発者や小規模チームがAIエージェントを日常の開発ワークフローに取り入れる際に役立ちます。コードベースの理解を助け、 hallucinations を減らす効果が期待できます。 実務では、大規模なコードベースでのエージェント利用時に特に有用で、開発コストの低減につながる可能性があります。 出典: Show HN: Faber, cost-efficient open-source coding agent that uses code graph
続きを読む

Claudeの電子透かし、仕組みと限界をAnthropicが公表

Anthropicが8月14日、Claudeの生成テキストに埋め込む電子透かしの仕組みを公表しました。Google DeepMindのSynthID-Textを基に、単語を選ぶ際の乱数の生成源を秘密鍵と直前の文脈に置き換え、鍵を持つ側だけが検出できる統計的なパターンを残す方式です。テキストに文字を足さないため、品質や速度、料金には影響しないとしています。 EU AI Actの透明性義務に関する行動規範へ署名したことに伴う対応ですが、適用範囲はEU域内にとどまりません。地域ごとに限定する確実な方法がまだないとして、日本を含む全世界のモデルとプロダクトに及びます。検出には近く提供予定のAPIを使います。 実務で効くのは、透かしが入る場所と入らない場所が明確な点です。単語選択の自由度が低い文章、たとえば数式や答えが一つしかない事実記述には入りません。コードも、別の語を選ぶと動かなくなる箇所には適用せず、コメントのような任意の選択ができる部分に限られます。句読点だけの校正は検出に足りない可能性がある一方、全ての単語をClaudeが選ぶ翻訳には入ります。 限界も明示されています。示せるのはClaudeが関与した可能性までで、書いたのか大幅に編集したのかは区別できません。人間が書いた証明にもならず、短文では精度が落ちます。AI利用の開示が求められる場面では、この範囲を踏まえた運用が要りそうです。 出典: 「Claude」の“見えない透かし”、Anthropicが仕組みを説明 「完全な書き直しなら消える」
続きを読む

AI & Tech Brief — 8 September 2026: Making AI Work Beyond the Lab

Edition: 8 September 2026 (Japan Standard Time) Overview Today's brief looks at three practical constraints on AI adoption: noisy inputs, access to defensive tools, and the efficiency of the infrastructure underneath. The selection combines a research team's 7 September update with two company announcements from the past week. Dates below refer to the original publications; these are not all new announcements today. Key takeaways ARTPARK-IISc describes a multilingual dataset for testing speech systems against real background noise. OpenAI has announced subsidized access and support intended to bring frontier cyber defense to organizations with fewer resources. Microsoft argues that useful outcomes, alongside infrastructure efficiency, should guide the next stage of AI expansion. Top stories 1. Speech AI gets a closer look at everyday noise Published: 7 September 2026. In a technical article, the ARTPARK-IISc team describes the Vaani Noise Event Timestamp Dataset: an...
続きを読む