Python: Model openai packages for Prompt injection

[mbaluda]

This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code, specifically targeting AI prompting APIs such as agents and openai. The changes include new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.

[github-actions]

QHelp previews:

python/ql/src/experimental/Security/CWE-1427/PromptInjection.qhelp

Prompt injection

Prompts can be constructed to bypass the original purposes of an agent and lead to sensitive data leak or operations that were not intended.

Recommendation

Sanitize user input and also avoid using user input in developer or system level prompts.

Example

In the following examples, the cases marked GOOD show secure prompt construction; whereas in the case marked BAD they may be susceptible to prompt injection.

from flask import Flask, request
from agents import Agent
from guardrails import GuardrailAgent

@app.route("/parameter-route")
def get_input():
    input = request.args.get("input")

    goodAgent = GuardrailAgent(  # GOOD: Agent created with guardrails automatically configured.
        config=Path("guardrails_config.json"),
        name="Assistant",
        instructions="This prompt is customized for " + input)

    badAgent = Agent(
        name="Assistant",
        instructions="This prompt is customized for " + input  # BAD: user input in agent instruction.
    )

References

• OpenAI: Guardrails.
• Common Weakness Enumeration: CWE-1427.

[Copilot]

Pull request overview

This PR implements a new prompt injection security query for Python code that detects when user-controlled input flows into AI model prompts. The implementation adds taint tracking models for the OpenAI and agents libraries to identify potential CWE-1427 (Prompt Injection) vulnerabilities.

• Adds a new py/prompt-injection query with supporting data flow analysis
• Implements models for openai and agents Python modules to track prompt injection sinks
• Introduces the AIPrompt concept to the codebase for modeling AI prompting mechanisms

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
python/ql/test/query-tests/Security/CWE-1427-PromptInjection/openai_test.py	Test file demonstrating prompt injection vulnerabilities in OpenAI API usage
python/ql/test/query-tests/Security/CWE-1427-PromptInjection/agent_instructions.py	Test file for agent instruction parameter injection
python/ql/test/query-tests/Security/CWE-1427-PromptInjection/PromptInjection.qlref	Query reference configuration for test execution
python/ql/test/query-tests/Security/CWE-1427-PromptInjection/PromptInjection.expected	Expected test results for the query
python/ql/src/Security/CWE-1427/examples/example.py	Example code showing good and bad practices for prompt construction
python/ql/src/Security/CWE-1427/PromptInjection.ql	Main query implementation for detecting prompt injection vulnerabilities
python/ql/src/Security/CWE-1427/PromptInjection.qhelp	Documentation and guidance for the prompt injection query
python/ql/lib/semmle/python/security/dataflow/PromptInjectionQuery.qll	Taint-tracking configuration for prompt injection detection
python/ql/lib/semmle/python/security/dataflow/PromptInjectionCustomizations.qll	Sources, sinks, and sanitizers for prompt injection analysis
python/ql/lib/semmle/python/frameworks/openai.model.yml	Model definitions for OpenAI API prompt injection sinks
python/ql/lib/semmle/python/frameworks/agent.model.yml	Model definitions for agents library prompt injection sinks
python/ql/lib/semmle/python/Concepts.qll	Adds AIPrompt concept for modeling AI prompting mechanisms
python/ql/lib/change-notes/2026-01-02-prompt-injection.md	Change notes documenting the new feature

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.