Safety #Coding agents Oct 8, 2026 · Originally published Oct 7

GitHub ships a purpose-built model for leaked secrets that reads surrounding code to catch unformatted passwords, coming to push protection and Copilot /security-review

GitHub is applying its own fine-tuned model to secret scanning across alerts, push protection and Copilot security reviews, and is publishing the billing model ahead of time.

Primary source GitHub Changelog · github.blog Read the original ↗

// Key points

The model reads surrounding code to identify likely credentials, including passwords without a recognizable token format, without generating code or prose.
Existing AI-detected secret alerts switch to the new model starting today at no additional charge for GHSP and GHAS customers; AI-detected alerts are coming to GHES 3.23 in public preview.
AI push protection is in private preview and flags unstructured credentials before they enter repository history; checks from the classifier are coming soon to /security-review in Copilot CLI and the Copilot app, also in private preview.
The new push protection and /security-review checks are off by default and opt-in, and consume GitHub AI Credits; a check can consume credits even if it does not block a push.

Builder's takeWith agents committing at every step, the odds of a secret slipping into history only go up, and blocking it at push time is far cheaper than rotating it later. I'd pilot push protection on repos that already have GHSP and set a budget cap on AI Credits, since checks bill even when nothing is blocked. GitHub's note that agents shouldn't enable credit-consuming features without explicit authorization is worth copying straight into a team's agent rules.

// Background · from #Coding agents

Full timeline →