GitHub: CodeQL 2.26 Introduces AI Prompt Injection Detection — First Mainstream SAST Tool to Treat AI Attacks on Par with Classic Ones

On July 10, 2026, GitHub released CodeQL 2.26.0, a version of its static security analysis tool that introduces detection of AI prompt injection attacks for the first time. CodeQL treats code as a database and runs security queries against it, finding vulnerabilities before they reach production — and as of this version, the list of covered attacks includes AI-specific vectors.

Why is this a turning point?

Prompt injection — inserting hidden instructions into a language model’s input to redirect its behavior — has until now been treated as a ‘soft’ AI problem, separate from classical software security. By entering CodeQL, a tool used by millions of repositories through GitHub Advanced Security, prompt injection gains the same status as XSS or SQL injection: it is automatically scanned on every pull request. This signals that the industry is beginning to treat AI attacks as a mainstream security risk rather than a research curiosity.

What exactly does it detect?

The new analysis type tracks data flows where untrusted input reaches a language model call without appropriate sanitization — a pattern that arises when an application passes user input directly into a prompt. This is especially relevant for the growing wave of applications embedding LLMs and agents, where the boundary between data and instructions becomes blurred.

Other highlights

Alongside the security news, CodeQL 2.26.0 adds support for Kotlin 2.4.0 and improves analysis for C#, Go, and JavaScript/TypeScript. The release arrives on the same day an arXiv paper on ‘Overthinking’ reveals a new class of extraction attacks on reasoning models — a dual reminder that the security of AI systems is becoming a serious, standalone discipline in 2026.