GitHub shipped CodeQL 2.26.0 on July 10 with the most practically significant security update for AI application developers in the last year: a static analysis query that detects prompt injection at the code level, the same way CodeQL has detected SQL injection for a decade. If you already have GitHub Code Scanning enabled on a JavaScript or TypeScript repository, you have it right now — no configuration required.
What the New Query Does
The js/system-prompt-injection query uses taint tracking to follow untrusted user-provided data from its entry point (HTTP request parameters, form inputs, query strings) to its exit point: an AI model’s system prompt. If your code routes that data into the system message of an OpenAI, Anthropic, or Google GenAI API call without proper separation, CodeQL flags it as a high-severity vulnerability.
The analogy holds precisely. When CodeQL flags db.query("SELECT * FROM users WHERE id=" + userId), it’s because untrusted data is controlling a privileged instruction. When it flags { role: "system", content: userInput }, the same logic applies.
The 2.26.0 release expands sink coverage beyond the basics. The query detects injections targeting OpenAI Realtime session instructions and Sora generation prompts, Anthropic’s messages API and legacy completion endpoints, and Google GenAI system instructions and cached content.
The Vulnerable Pattern — and the Fix
Vulnerable antipattern:
const userInput = req.body.message;
const response = await openai.chat.completions.create({
model: "gpt-5.6-sol",
messages: [
{ role: "system", content: `You are a helpful assistant. Context: ${userInput}` },
{ role: "user", content: "Help me." }
]
});Safe pattern:
const response = await openai.chat.completions.create({
model: "gpt-5.6-sol",
messages: [
{ role: "system", content: "You are a helpful assistant." },
{ role: "user", content: userInput }
]
});How to Enable Code Scanning
For public repositories, GitHub Code Scanning is free. Settings → Advanced Security → CodeQL analysis → Set up → Default → Enable. Every new CodeQL version is deployed automatically to github.com — if you already have Code Scanning enabled, you received 2.26.0 on July 10 without doing anything.
The Rest of 2.26.0
Kotlin support now extends to 2.4.0. Go’s log/slog package finally gets coverage for log injection and clear-text logging vulnerabilities. C# Razor Page handler parameters are now treated as remote flow sources.
Where the Query Falls Short
The js/system-prompt-injection query covers JavaScript and TypeScript only. Python coverage for this query is not in 2.26.0.
The query also does not detect indirect prompt injection — where an attacker embeds instructions in external content that flows back into the model’s context.
What This Marks
Prompt injection has been treated as a model alignment problem. CodeQL 2.26.0 disagrees with that framing. It treats the vulnerable pattern as a programming error, detectable and fixable at the code level. Direct prompt injection — where your own application routes user input into privileged model instructions — is not a model failure. It’s a code failure.