{"version":"1.0","generated_at":"2026-10-08T00:32:57.402990","id":1744,"slug":"codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection","title":"CodeQL 2.26.0 新增 Kotlin 2.4.0 支持与 AI 提示注入检测","summary":"GitHub 发布 CodeQL 2.26.0，添加对 Kotlin 2.4.0 的支持，引入 JavaScript/TypeScript 系统提示注入查询，并提升多语言分析准确性。","abstract":"CodeQL 2.26.0 新增 Kotlin 2.4.0 支持与 AI 提示注入检测 GitHub 发布 CodeQL 2.26.0，添加对 Kotlin 2.4.0 的支持，引入 JavaScript/TypeScript 系统提示注入查询，并提升多语言分析准确性。 GitHub 发布 CodeQL 2.26.0，添加对 Kotlin 2.4.0 的支持，引入 JavaScript/TypeScript 系统提示注入查询，并提升多语言分析准确性。 原贴提到：CodeQL is the static analysis engine behind GitHub code scanning , which 来源：github.blog CodeQL 是 GitHub 代码扫描背后的静态分析引擎，用于查找和修复代码中的安全问题。我们最近发布了 CodeQL 2.26.0，该版本新增了对 Kotlin 2.4.0 的支持，引入了一个用于系统提示注入的 JavaScript 和 TypeScript 查询，并提升了多种语言的分析准确性。 Kotlin：CodeQL 现在支持高达 2.4.0 的 Kotlin 版本。 C#：我们添加了 Razor 页面处理程序方法参数，例如 OnGet、OnPost 和 OnPostAsync 的参数，作为远程流来源。诸如 cs/sql-injection 之类的安全查询现在可以检测 PageModel 子类中涉及这些参数的漏洞。 Go：我们为 Go 1.21 中引入的 log/slog 包添加了模型。go/log-injection 和 go/cle…","access_level":"member","access_label":"免费阅读","access_mode":"full","is_preview":false,"canonical_url":"https://opc.beizhux.com/content/1744/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection","html_url":"https://opc.beizhux.com/content/1744/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection","json_url":"https://opc.beizhux.com/content/1744/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection.json","published_at":"2026-07-11T04:40:56","updated_at":"2026-10-08T00:19:58","category":{"slug":"ai-skills","name":"AI技能杠杆"},"source":{"site":"github.blog","author":"Allison","url":"https://github.blog/changelog/2026-07-10-codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection"},"tags":["AI","AI安全","AI提示注入","C#","CodeQL","DevSecOps","GitHub","GitHub Changelog","GitHub代码扫描","Go","JavaScript","Kotlin"],"topics":[{"slug":"agent-workflow","name":"Agent工作流","url":"https://opc.beizhux.com/topics/agent-workflow","reason":"这篇内容命中「Agent、工作流」等主题信号。"},{"slug":"ai-super-individual","name":"AI超级个体","url":"https://opc.beizhux.com/topics/ai-super-individual","reason":"这篇内容命中「技能」等主题信号。"},{"slug":"ai-tools","name":"AI工具","url":"https://opc.beizhux.com/topics/ai-tools","reason":"这篇内容来自该专题长期覆盖的栏目。"}],"keywords":["AI技能杠杆","Agent工作流","AI超级个体","AI工具","工具","自动化","模型","Cursor","Claude","Agent","智能体","工作流"],"questions":[{"question":"CodeQL 2.26.0 新增 Kotlin 2.4.0 支持与 AI 提示注入检测主要讲什么？","answer":"GitHub 发布 CodeQL 2.26.0，添加对 Kotlin 2.4.0 的支持，引入 JavaScript/TypeScript 系统提示注入查询，并提升多语言分析准确性。"},{"question":"这篇文章最值得关注的要点是什么？","answer":"GitHub 发布 CodeQL 2.26.0，添加对 Kotlin 2.4.0 的支持，引入 JavaScript/TypeScript 系统提示注入查询，并提升多语言分析准确性。；原贴提到：CodeQL is the static analysis engine behind GitHub code scanning , which；来源：github.blog"},{"question":"这篇文章和哪些AI专题相关？","answer":"它适合放在Agent工作流、AI超级个体、AI工具专题里阅读。 关联原因：这篇内容命中「Agent、工作流」等主题信号。；这篇内容命中「技能」等主题信号。；这篇内容来自该专题长期覆盖的栏目。"},{"question":"阅读这篇文章建议先理解哪些关键词？","answer":"建议先理解AI工具、工具、自动化、模型、Cursor这些关键词，再结合正文判断工具、机会或风险是否值得进入自己的工作流。"}],"terms":[{"slug":"ai-tools-term","name":"AI工具","definition":"在AI觉醒星球里，「AI工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-tools-term","path":"/glossary/ai-tools-term","json_url":"https://opc.beizhux.com/glossary/ai-tools-term.json"},{"slug":"tools","name":"工具","definition":"在AI觉醒星球里，「工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/tools","path":"/glossary/tools","json_url":"https://opc.beizhux.com/glossary/tools.json"},{"slug":"automation","name":"自动化","definition":"在AI觉醒星球里，「自动化」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/automation","path":"/glossary/automation","json_url":"https://opc.beizhux.com/glossary/automation.json"},{"slug":"ai-model","name":"模型","definition":"在AI觉醒星球里，「模型」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-model","path":"/glossary/ai-model","json_url":"https://opc.beizhux.com/glossary/ai-model.json"},{"slug":"cursor","name":"Cursor","definition":"在AI觉醒星球里，「Cursor」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/cursor","path":"/glossary/cursor","json_url":"https://opc.beizhux.com/glossary/cursor.json"},{"slug":"claude","name":"Claude","definition":"在AI觉醒星球里，「Claude」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/claude","path":"/glossary/claude","json_url":"https://opc.beizhux.com/glossary/claude.json"},{"slug":"agent","name":"Agent","definition":"在AI觉醒星球里，「Agent」属于「Agent工作流」方向。聚合Agent、AI编程、Claude Code、Cursor、工作流自动化等内容，帮助你把智能体能力落到真实任务链路。 把智能体当成任务系统，而不是聊天窗口。","topic_slug":"agent-workflow","topic_name":"Agent工作流","topic_title":"Agent工作流：智能体、AI编程与自动化协作","topic_url":"https://opc.beizhux.com/topics/agent-workflow","topic_path":"/topics/agent-workflow","url":"https://opc.beizhux.com/glossary/agent","path":"/glossary/agent","json_url":"https://opc.beizhux.com/glossary/agent.json"},{"slug":"ai-agent","name":"智能体","definition":"在AI觉醒星球里，「智能体」属于「Agent工作流」方向。聚合Agent、AI编程、Claude Code、Cursor、工作流自动化等内容，帮助你把智能体能力落到真实任务链路。 把智能体当成任务系统，而不是聊天窗口。","topic_slug":"agent-workflow","topic_name":"Agent工作流","topic_title":"Agent工作流：智能体、AI编程与自动化协作","topic_url":"https://opc.beizhux.com/topics/agent-workflow","topic_path":"/topics/agent-workflow","url":"https://opc.beizhux.com/glossary/ai-agent","path":"/glossary/ai-agent","json_url":"https://opc.beizhux.com/glossary/ai-agent.json"}],"preview_hidden_sections":[],"related_items":[{"id":3269,"title":"与 Codex 对话，让键盘休息一下：","url":"https://opc.beizhux.com/content/3269/talk-to-codex-and-give-your-keyboard-a-break","summary":"OpenAI Devs 在 X 上发布一句提示：与 Codex 对话，让键盘休息一下。信号指向用自然语言或语音方式调用 Codex、减少键盘输入，但未披露具体功能、平台与可用范围。","access_level":"member"},{"id":3227,"title":"Kepler 论文：ARC-AGI-3 智能体满分可能源于读源码，需审查动作过程而非只看结果","url":"https://opc.beizhux.com/content/3227/kepler-arc-agi-3","summary":"一篇 ARC-AGI-3 相关论文指出，智能体可通过读取 2,172 行游戏源码拿到满分 100，从而掩盖真实能力；在清理并重跑后，同一游戏仅得 46.91。作者建议评测时用真实访问限制封锁答案，并检查智能体的动作日志。","access_level":"member"},{"id":3221,"title":"开源“BootLoops”工具支持 AI 模型进行精确科学计算","url":"https://opc.beizhux.com/content/3221/open-source-bootloops-harness-supports-ai-models-in-performing-precise-scientific-calculations","summary":"哈佛物理学家 Matthew Schwartz 构建开源工具 BootLoops，用语言模型执行精确科学计算并连接跨学科知识缺口。三个月内团队与 19 位合著者产出 36 篇手稿，覆盖 18 个领域。但 Schwartz 警告模型常过早宣布胜利或从正确计算得出错误结论，人类监督与领域专家验证不可替代。","access_level":"member"}],"usage_policy":{"summarizable":true,"preferred_url":"https://opc.beizhux.com/content/1744/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection","private_fields_excluded":true}}