What changed is not just another ruleset—it’s a bridge between AI safety concerns and mature AppSec workflows. CodeQL now traces untrusted values that can shape a model’s system prompt, and flags when these flows reach sensitive SDK calls. By expanding sinks for major vendors’ APIs, the detection recognizes real-world patterns developers use to assemble system instructions, session policies, and tool wiring. The outcome is a familiar security event: a dataflow finding that can be triaged, fixed, and prevented by policy, rather than an ambiguous “AI misbehavior” anecdote that rarely maps to CI/CD controls.

For engineering leaders, this reframes prompt injection as a dependency hygiene and input validation problem. When system prompts inherit user-controllable strings—feature flags, tenant settings, or CMS content—models can be coerced to bypass instructions, expose tools, or leak context. CodeQL’s approach brings those risks into SARIF, PR annotations, and baseline metrics, enabling the same escalation paths as classic injection classes. Crucially, it helps product owners quantify risk in terms auditors understand: dataflow from untrusted sources to sensitive sinks, backed by reproducible queries and versioned policy.

Adopting this capability is less about rewriting prompts and more about codifying boundaries. Teams should pin a current CodeQL version, enable the new system prompt‑injection query for JS/TS, and run organization-wide baselines. Start with repositories that build agents, tool-calling, or RAG pipelines; then expand to services where prompts are assembled from configuration. Triage guidance should classify flows by exploitability: degree of user control, presence of templating safeguards, and downstream tool power. Where gaps persist, write small custom models for proprietary SDK calls to ensure coverage parity with your actual production interfaces.

Expect limits: static analysis can’t fully simulate dynamic tool graphs, cross-service prompt composition, or runtime guardrails like function calling constraints. But the same was true for SSRF or deserialization until ecosystems normalized patterns and linters. The bigger picture is convergence: AI risks are being normalized into SDLC gates, creating a common language across security, platform, and compliance. That raises the bar for vendors and internal platforms alike—shipping AI features without code-scanning coverage will increasingly look like shipping APIs without auth tests.