A clean scan does not make a prompt safe; separate trusted instructions from user content, minimize tool permissions, and test the full data path.
Update — August 12, 2026: This guide now explains that the new rule is a taint-flow signal, how to triage it, and why the query does not assess runtime tool permissions or every prompt boundary.
CodeQL 2.26.0 adds a JavaScript and TypeScript query that detects when untrusted, user-controlled values flow into an AI model’s system prompt. The release also expands modeled prompt-injection sinks across several AI SDK APIs.
This is a useful shift from searching for suspicious strings to tracing data flow. The security question becomes: can content controlled by someone else reach the instruction channel that defines how the model should behave?
What the new query covers
The `js/system-prompt-injection` query targets untrusted values reaching a system prompt. GitHub also added sinks for APIs involving OpenAI Realtime instructions, Anthropic legacy completion prompts, Google GenAI cached content and system instructions, and other SDK surfaces.
CodeQL 2.26.0 is automatically deployed to GitHub.com code scanning users. GitHub Enterprise Server customers will receive it in a future release or can manually upgrade CodeQL on older versions.
What static analysis cannot decide for you
A tool can identify a data path, but it cannot fully determine the business consequence of a manipulated prompt. Impact depends on what tools the model can call, what data it can retrieve, whether actions require approval, and whether output reaches another trusted system.
Review each finding in context. A summarizer with no tools has a different risk profile from an agent that can send email, modify records, or execute deployment commands.
Triage the path before changing the prompt
The CodeQL library describes this detection as taint tracking: it looks for a path from a default untrusted source to a modeled prompt-injection sink. That is a useful review queue, not a verdict that an attacker has taken control of the model. Read the source, every transformation on the path, the final API call, and the execution context before declaring the result fixed or benign.
A finding is higher priority when untrusted content can alter instructions for an agent that has broad data access or can take consequential actions. It is lower priority, but not automatically harmless, when the model only produces an untrusted draft that another system does not execute. Write that impact decision in the alert so the next reviewer understands the boundary that was assessed.
- Identify the real-world actor who controls the data at the reported source.
- Confirm whether the value is appended to instructions, retrieved context, a tool argument, or only a user-facing draft.
- List the tools, credentials, data scopes, approvals, and downstream systems available to that model call.
- Add a regression test that sends representative hostile content through the same path.
- Retain the reasoning for accepted risk, false positives, and compensating controls.
Build defense around the model
Keep trusted instructions separate from retrieved or user-provided text, label untrusted content, validate tool arguments, use least-privilege credentials, and require confirmation for consequential actions. Add adversarial test cases to CI so a fixed flow does not quietly reappear.
- Trace the source of every value inserted into system instructions.
- Limit tools and data to the current task.
- Validate outputs before they become commands or database changes.
- Log model actions without exposing secrets in the log itself.
Keep the query set current, but do not outsource the threat model
CodeQL 2.26.0 introduced `js/system-prompt-injection` for JavaScript and TypeScript. It detects modeled data flows; it cannot prove the absence of a prompt-injection route in an unsupported SDK, a custom wrapper, a different language, or behavior assembled at runtime. Review the enabled query suite and CodeQL version whenever the application changes its AI SDK or agent architecture.
The durable control is architectural: treat retrieved web pages, user requests, issue text, documents, and tool outputs as untrusted data; constrain what the model can do with them; and require an explicit verification step before irreversible actions. Static analysis is strongest when it makes that review routine, not when it is treated as the complete defense.
This article explains the practical implications of the primary material below. PatchMemo does not publish vendor copy as editorial coverage and does not accept payment for positive coverage.
PatchMemo independently selects and evaluates the topics it covers. Analysis and recommendations are ours; sources are linked so readers can check the underlying claims. We clearly label sponsorships and affiliate relationships, and neither determines coverage or conclusions.
