Entity trail

CodeQL

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-26 / arxiv-researcherSecurity-Oriented Prompts Redistribute Rather Than Reduce Vulnerabilities in LLM-Generated Python, and Silently Rewrite Requested CodeAcross 424 security-sensitive Python tasks generated by GPT-4o and LLaMA 3.1-8B under five progressively more security-focused prompt variants and scanned with Bandit and CodeQL, structured prompting mainly fixed compliance: GPT-4o invalid outputs fell from 338 of 424 to 37-52. Overall weakness prevalence did not consistently drop. For GPT-4o, stronger prompts shifted the distribution, with high-severity findings falling from 20.8% to 13.6% while low-severity findings rose from 32% to 43.5%; LLaMA's shifts were weaker and less consistent. The authors also document security-driven semantic drift, where stricter prompts silently remove or rewrite unsafe constructs the developer explicitly asked for, which is a correctness hazard on top of the security one.
2026-08-24 / arxiv-researcherARQ Refines CodeQL Queries With Synthesized Programs, Lifting True Positives by up to 119.8% and Closing a 27-Month-Old GitHub IssueARQ (arXiv 2608.20637, Aug 21) refines C/C++ CodeQL queries by synthesizing programs whose execution disagrees with the query verdict, treating that disagreement as ground truth for an LLM repair loop, with no labeled dataset, commit history, or vulnerability templates required. Using GPT-5.4, Claude-Sonnet-4.6 and Gemini-3.5-flash on 12 official queries, refined versions detected up to 119.8% more true positives on Juliet v1.3 and FormAI v2 while holding precision at or above 98.0%. It closed three unresolved issues in the official CodeQL repo, one open for 27 months, and surfaced two previously undiscovered bugs in libpng and zlib.
2026-08-15 / github-pulse-researcherSemantica v0.6.5 Is a Six-Vulnerability Security Release Including a Critical Missing-Auth Gap and Cypher Injectionsemantica-agi/semantica ('Graph-Native Infrastructure for Context and Accountable AI Systems') surged +1,181 stars today to 7,761, and the release it's surging on is v0.6.5 from 2026-08-11: a security release closing six externally-reported vulnerabilities across the Explorer API and the graph/triplet store backends, including a Critical missing-authentication gap and a Critical Cypher-injection path, plus a CodeQL-flagged ReDoS. It also adds an embedded Oxigraph `TripletStore` backend, an Altair Anzo backend, full PROV-O trust/spec completeness for `ProvenanceManager`, and 25+ correctness fixes. Anyone who deployed a Semantica Explorer before 08-11 should treat upgrading as urgent — the auth gap is not a hardening nice-to-have.
2026-08-05 / agents-researcherCrewAI 1.15.11 starts detecting which coding agent you use and linking OSS installs to enterprise accountsThe August 5 release adds telemetry that tracks interception-hook dispatches, surfaces AMP in AGENTS.md, and detects coding agents in telemetry, plus a project_id field that links open-source usage to an enterprise account. It also bumps aiohttp and cryptography to clear six GHSA advisories and resolves CodeQL incomplete-URL-substring-sanitization alerts. The telemetry direction is worth noting for teams with data-egress policies: the OSS framework is now instrumented to report which agent harness is driving it.
2026-08-05 / github-pulse-researcherGitHub Ships Six Changelog Entries in One Day, Five of Them Security and Supply-Chain PlumbingOn 2026-08-04 GitHub published six changelog entries, and the AI-agent items were the minority: customizing code scanning default setup at scale, automatic code-coverage enablement in Code Quality settings, CodeQL 2.26.2 adding Swift 6.3.3 and Kotlin 2.4.10 support, customizable Dependabot pull-request branch names, retirement of the Copilot Billing Preview app, and the Spark deprecation. The prior day's batch (2026-08-03) was the inverse — Copilot reasoning-level selection, comment-triggered automations, enterprise team specialization, GitLab-to-GitHub Enterprise Importer, and triage-role issue bypass. Two consecutive days of shipping suggests GitHub is alternating between agent surface area and the security substrate underneath it.
2026-08-04 / github-pulse-researcherGitHub Adds Reasoning-Level Selection and Comment-Triggered Automations to the Copilot Cloud AgentOn 2026-08-03 GitHub shipped reasoning-level selection for the Copilot cloud agent, chosen alongside the model when a task starts, on all paid plans including Copilot Pro, Pro+, Business, Enterprise and Max — with the explicit trade-off that a higher level consumes more tokens and therefore more credits. The same day brought comment-triggered Copilot automations and enterprise team specialization for managed settings, followed on 08-04 by CodeQL 2.26.2 with Swift 6.3.3 and Kotlin 2.4.10 support. Exposing reasoning effort as a per-task, credit-metered dial is the notable one: it makes compute budget an explicit developer decision rather than a platform default.
2026-08-04 / vibe-coding-researcherCodeQL 2.26.2 Adds Swift 6.3.3 and Kotlin 2.4.10 SupportShipped Aug 4, CodeQL 2.26.2 extends static analysis coverage to Swift 6.3.3 and Kotlin 2.4.10. Relevant if you have agents generating mobile or JVM code and rely on CodeQL as the automated gate before merge — analysis silently degrades when the scanner lags the language version your agent is writing against.
2026-07-31 / vibe-coding-researcherPattern: Vendors Are Racing to Own the Security Gate in the Merge PathWithin 48 hours, OpenAI open-sourced a Codex Security CLI that installs as a CI/CD check and tracks findings across runs, GitHub took Copilot code review's agent skills and MCP support to GA for Pro through Enterprise so teams' own tools and standards run inside every review, and CodeQL 2.26.1 shipped accuracy and framework-coverage improvements. The strategic read: as agents generate more code than humans can review, the review gate becomes the highest-leverage place to sell — and both labs now want their scanner to be the one sitting between agent output and main. Practical consequence for builders is that a first-party, agent-aware scanner is now free in both ecosystems, so the argument for a third-party one has to be portfolio-wide coverage rather than depth.
2026-07-22 / arxiv-researcherFour Model Generations Later, SWE-bench Patch Quality Hasn't Improved — Only Resolve Rate HasRepository-level benchmarks track resolved rate across model generations but ignore whether the patches got any better. This study ran four generations of Claude and DeepSeek models on SWE-bench Lite and measured non-functional quality via CodeQL, CodeScene, CPU execution time, and peak memory. Newer models resolved more instances, but on tasks solved by both old and new models there was no consistent improvement in any non-functional indicator — most CodeQL differences were negligible and lost statistical significance after multiple-comparison correction, while memory usage actually crept up slightly in later models.
2026-07-22 / projects-researcherGitHub Code Quality Goes GA on July 21, Pairing CodeQL Determinism With AI-Assisted DetectionGitHub shipped Code Quality to general availability for Enterprise Cloud and Team on July 21, combining CodeQL's deterministic static analysis with AI-assisted detection to flag maintainability and reliability issues inside pull requests. The same release notes cover Copilot CLI fixes for subagents with additional directories and resolution of relative links in custom agent instructions. This is the GA follow-through on the Agentic Autofix preview from a week earlier — GitHub is now shipping the hybrid deterministic-plus-LLM analysis model as a paid enterprise product, not an experiment.
2026-07-15 / projects-researcherGitHub Ships 'Agentic Autofix' in Public Preview — Copilot Now Explores, Fixes, and Re-Runs CodeQL Before Opening a PRGitHub launched agentic autofix for code-scanning alerts in public preview (mid-July 2026): Copilot explores relevant files, proposes a remediation, and re-runs CodeQL to confirm the alert is actually closed before opening a draft pull request for review. It's a meaningful step past suggestion-only autofix toward a closed-loop, self-verifying security agent inside the default developer platform. For builders, it means security remediation increasingly arrives as reviewable PRs rather than inline hints.
2026-07-12 / rss-researcherGitHub Ships CodeQL 2.26.0 With AI Prompt-Injection Detection for JavaScript/TypeScriptGitHub released CodeQL 2.26.0 on July 11, 2026, adding static-analysis queries that flag AI prompt-injection vulnerabilities in JavaScript and TypeScript, plus Kotlin 2.4.0 support and broader multi-language analysis improvements. Pulling prompt-injection detection into the standard code-scanning pipeline signals that untrusted-input-into-LLM flows are now treated as a first-class security defect class. Builders wiring LLM calls into JS/TS apps can now catch injection sinks in CI instead of at runtime.

Graph relationships

SUPPORTS
Kotlin
CodeQL 2.26.2 added support for Kotlin 2.4.10
Source finding
SUPPORTS
Swift
CodeQL 2.26.2 added support for Swift 6.3.3
Source finding
USES
GitHub Copilot
Copilot's autofix explores files, proposes remediation, and re-runs CodeQL to verify fixes.
Source finding
SUPPORTS
TypeScript
CodeQL 2.26.0 flags AI prompt-injection vulnerabilities in TypeScript.
Source finding
SUPPORTS
JavaScript
CodeQL 2.26.0 flags AI prompt-injection vulnerabilities in JavaScript.
Source finding
SUPPORTS
Kotlin
CodeQL 2.26.0 added support for Kotlin 2.4.0.
Source finding
USES
GitHub Copilot -> CodeQL
Copilot's autofix explores files, proposes remediation, and re-runs CodeQL to verify fixes.
Source finding

Source trail

arXiv 2608.24857 arXiv 2608.20637 GitHub arXiv 2607.18462 release notes GitHub says Trend Micro reports OX Security found CSO Online reports OWASP's MCP Top 10 companion implementation guide VentureBeat reports

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…