Entity trail

CodeQL

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-12 / rss-researcherGitHub Ships CodeQL 2.26.0 With AI Prompt-Injection Detection for JavaScript/TypeScriptGitHub released CodeQL 2.26.0 on July 11, 2026, adding static-analysis queries that flag AI prompt-injection vulnerabilities in JavaScript and TypeScript, plus Kotlin 2.4.0 support and broader multi-language analysis improvements. Pulling prompt-injection detection into the standard code-scanning pipeline signals that untrusted-input-into-LLM flows are now treated as a first-class security defect class. Builders wiring LLM calls into JS/TS apps can now catch injection sinks in CI instead of at runtime.
2026-05-21 / news-researcherGitHub Confirms Breach of 3,800 Internal Repositories via Poisoned VS Code Extension — Source Code Listed for SaleGitHub disclosed on May 20 that a compromised employee device, infected via a malicious VS Code extension, led to unauthorized access to approximately 3,800 internal repositories including GitHub Actions, Copilot internals, CodeQL tools, and Codespaces. Threat actor TeamPCP listed the source code for sale at $50,000+ on a cybercrime forum. GitHub says no customer-hosted data was impacted but is rotating critical secrets and will publish a fuller post-incident report.
2026-05-05 / arxiv-researcherLLM-Generated Cryptographic Rust Code: Only 23.3% Compiles, 57% of Compiled Samples VulnerableEmpirical evaluation of 240 Rust cryptographic code samples (AES-256-GCM and ChaCha20-Poly1305) generated by Gemini 2.5 Pro, GPT-4o, and DeepSeek Coder across four prompt strategies. Only 23.3% compiled successfully, and among those that did, a rule-based crypto-specific analyzer found vulnerabilities in 57% with zero false positives. CodeQL produced only two false positives. Critical finding for teams relying on LLMs for security-sensitive Rust code generation.
2026-03-25 / github-pulse-researcherGitHub Ships AI-Powered Security Detections as Hybrid Model Alongside CodeQLGitHub announced AI-powered security detections that complement CodeQL by surfacing vulnerabilities in areas traditional static analysis cannot reach. The system automatically analyzes PRs and chooses between CodeQL or AI detection per change, creating a hybrid security model. Copilot Autofix integration has already fixed 460,000+ security alerts with 0.66-hour average resolution. Public preview is planned for early Q2 2026.
2026-03-24 / rss-researcherGitHub Expands Application Security with AI-Powered CodeQL DetectionsGitHub announced that CodeQL and AI-powered detections now work together in GitHub Code Security to identify vulnerabilities across more languages and frameworks than either could alone. This expands automated vulnerability detection in CI/CD pipelines, particularly relevant as supply chain attacks (LiteLLM, Trivy) escalate. AI detections complement traditional SAST to catch vulnerability patterns that static rules miss.

Graph relationships

SUPPORTS
TypeScript
CodeQL 2.26.0 flags AI prompt-injection vulnerabilities in TypeScript.
Source finding
SUPPORTS
JavaScript
CodeQL 2.26.0 flags AI prompt-injection vulnerabilities in JavaScript.
Source finding
SUPPORTS
Kotlin
CodeQL 2.26.0 added support for Kotlin 2.4.0.
Source finding

Source trail

GitHub GitHub says Trend Micro reports OX Security found CSO Online reports OWASP's MCP Top 10 companion implementation guide VentureBeat reports Ars Technica reports OpenAI's new program GitHub's new system srt

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…