CodeQL 2.26.0: What Does the System Prompt Injection Query Catch in AI Applications?

Why prompt injection belongs in static analysis

Prompt injection is often discussed as a runtime behavior, but many dangerous patterns are visible in code. If untrusted content can flow into privileged prompt instructions, tool definitions or system messages, the application may let external data influence model behavior.

Static analysis helps teams find these paths before deployment.

What the query looks for

The relevant pattern is a data flow from an untrusted source into a sensitive prompt sink. Sources can include request parameters, documents, scraped pages, user messages, retrieved content or third-party API responses.

Sensitive sinks can include system prompts, hidden instructions, tool routing decisions or model calls where trusted and untrusted content are merged without boundaries.

Developer checklist

• Keep system prompts separate from user-controlled content.
• Label retrieved or external content explicitly.
• Avoid building prompts through raw string concatenation.
• Add allowlists for tools and actions.
• Test with malicious or conflicting instructions in retrieved content.

Business impact

AI application security is becoming part of normal application security. Static analysis can reduce review burden and make AI-specific risks visible in pull requests.