SNACK Three-Line Summary
- GitHub released CodeQL 2.26.0 on July 10. Beyond Kotlin 2.4.0 support, it adds prompt injection detection directly tied to AI app security.
- The js/system-prompt-injection query for JavaScript/TypeScript has been added. It looks for cases where untrusted user input flows into an AI model’s system prompt.
- The point is that prompts are becoming part of code security checks. AI apps using OpenAI, Anthropic, or Google GenAI SDKs now need to examine input flows and system-instruction boundaries more strictly.
Snackgirls editor note
AIKO: “This is a sign that security tools are changing for the AI era. The trend is to catch paths where user input enters the system prompt through code scanning.”
Red: “When building AI apps, it’s risky to think of prompts as just sentences. Now input values, SDK calls, and system instructions all belong in security design.”
What’s new in this release
GitHub announced CodeQL 2.26.0 in its official Changelog on July 10. CodeQL is the static analysis engine behind GitHub code scanning that finds security issues in code.
This update includes Kotlin 2.4.0 support, along with query improvements for C#, Go, Python, Swift, and GitHub Actions. But for AI-focused readers, the most important change is the addition of a query that detects system prompt injection in JavaScript/TypeScript.
What it means to code-scan for prompt injection
According to GitHub, the new js/system-prompt-injection query finds cases where untrusted user-provided values flow into an AI model’s system prompt. If an attacker abuses that flow, they may be able to influence the model’s behavior.
Put simply, it checks whether a sentence entered by a user does not stop as a normal question, but gets mixed close to the AI’s “operating rules.” Code analysis tools have begun tracking the moment when prompts become a security boundary, not just screen copy.
Why OpenAI, Anthropic, and Google SDKs were mentioned
The Changelog also explains that prompt injection sinks were added for OpenAI, Anthropic, and Google GenAI SDK APIs on the JavaScript/TypeScript side. Examples mentioned include Sora prompts, OpenAI Realtime session instructions, Anthropic legacy completion prompts, and Google GenAI cached content and system instructions.
This matters because AI apps no longer end with a single model call. When voice sessions, cached content, system instructions, and SDKs from multiple companies are combined, it becomes harder to trace where user input crosses into rule-setting areas. The fact that CodeQL has started treating this path as a query means developer tools are beginning to view AI app architecture as a real security target.
What developers should check right away
Teams building AI apps do not need to treat this update as a simple version bump. In code review, they should separate and inspect the paths where user input enters system prompts, session instructions, tool instructions, or cached content. Even when automated scan results appear, the actual risk should be judged together with the app’s permissions, tool execution scope, logs, and access to user data.
This is especially important for agent-style apps, where models often call external tools or read files. In those cases, prompt injection can go beyond “the model says something strange” and become a security issue that affects tool permissions and data access.
Game Sunakku take
CodeQL 2.26.0 is not as flashy as a major model announcement. In practical terms, though, it is quite important. As more apps add AI features, prompts and SDK calls also need to be inspected and recorded like traditional code vulnerabilities.
In short, the next step in AI security is moving closer to “track prompt flows inside the code,” not simply “use models carefully”. Teams using GitHub code scanning may want to add CodeQL 2.26.0’s AI-related queries to their update checklist.
Sources and checked date · Published 2026-07-10 / Checked 2026-07-14T01:06:05+00:00
Sources
Leave a comment