GitHub released CodeQL 2.26.0 on July 10, 2026. The most important AI-related part is that prompt injection is moving from a security discussion topic into a formal static analysis rule.
CodeQL is the static analysis engine behind GitHub code scanning. GitHub says version 2.26.0 adds Kotlin 2.4.0 support, introduces a JavaScript and TypeScript query for system prompt injection, and improves analysis accuracy across multiple languages. For AI app developers, the practical change is that scanning can now look for untrusted input flowing into a system prompt.
The new "js/system-prompt-injection" query detects when user-provided values flow into an AI model's system prompt. The risk is that an attacker can manipulate model behavior. When the model is connected to tools, databases, retrieval, browsers, or internal APIs, prompt injection can become an operational system risk rather than only a content issue.
GitHub also expanded prompt injection sinks for additional OpenAI, Anthropic, and Google GenAI SDK APIs, including Sora prompts, OpenAI Realtime session instructions, Anthropic legacy completion prompts, and Google GenAI cached content and system instructions. That shows AI security scanning expanding alongside SDK and product surfaces.
The practical takeaway for engineering teams is that AI app trust boundaries need to be treated like web app input boundaries. Many prompts used to be ordinary string assembly. Now system prompts, developer messages, tool instructions, and cached context can be high-privilege control surfaces. If arbitrary user content reaches those surfaces, the model may be steered away from the intended policy.
Putting prompt injection into a CodeQL query also sends a broader signal: AI security is becoming an engineering discipline. Teams should not rely only on manual prompt review. AI-specific risks need to enter CI, code scanning, and security gates. This matters especially for agent systems, where outputs can trigger tools, write code, read internal data, or affect customer workflows.
CodeQL 2.26.0 also improves C#, Go, Python, Swift, and GitHub Actions analysis, including Razor Page remote flow sources, Go slog logging queries, and SSRF IPv6 transition guard detection. The larger pattern is that GitHub is putting conventional application security and AI application security into the same scanning foundation.
The key point is that prompt injection is becoming a defect type that can be checked on every pull request. Teams building AI workflows, AI marketing tools, or agent products should treat that as a baseline security signal.
