Back to feed
Dev.to
Dev.to
7/16/2026
Build a Prompt-Injection Regression Fixture for CodeQL 2.26.0

Build a Prompt-Injection Regression Fixture for CodeQL 2.26.0

Short summary

CodeQL 2.26.0 adds AI prompt-injection detection, and the author shows how to build a regression fixture that makes this detection an executable contract. The fixture includes positive cases with untrusted-to-model data flow paths, a negative control, and expected-alerts JSON for CI gating. Static analysis cannot replace runtime adversarial tests, but it can prevent a critical security query from silently disappearing.

  • •Create positive and negative prompt-injection fixtures for CodeQL 2.26.0
  • •Gate CI on expected SARIF results, not total alert counts
  • •Keep runtime adversarial tests alongside static analysis

Generated with AI, which can make mistakes.

#ai-tools#ai-agents#open-source
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

The original title is: "Prompt Injection Isn't Fixed by a Filter. It's Fixed by Architecture"
Dev.to
The original headline is "Prompt Injection: The AI Security Hole Every Builder Should Know"
Dev.to
The original title is: "Prompt Injection Tester: 5 attack classes for auditing system prompt resilience"
Dev.to
MeghRoop Tech Blog
Dev.to