GitHub CodeQL 2.27.3: Scan AI-Generated Code for Flaws

GitHub shipped CodeQL 2.27.3 on November 3 with an opt-in AI threat model that tracks LLM output through your codebase and flags classic injection vulnerabilities — XXE, NoSQL, XML bomb — when they originate from AI-generated data. The catch: it arrives with zero built-in source models. Enable it and absolutely nothing changes until you write data extensions telling CodeQL which functions return AI-generated content. That gap is intentional (every codebase integrates LLMs differently), but it means teams that don’t take action get no benefit from the feature. Here’s what changed and what to configure.

The AI Threat Model: Powerful Framework, Blank Canvas

The core idea is straightforward. LLM output is untrusted data, the same way HTTP request parameters are. If your code takes a ChatGPT response and passes it into an XML parser or a MongoDB query without sanitization, that’s an injection waiting to happen — especially in agentic pipelines where prompt injection can influence what the LLM generates. CodeQL’s AI threat model lets you model that data flow so the existing injection queries can trace it.

What 2.27.3 adds is the framework for this. The queries py/xxe, py/xml-bomb, and py/nosql-injection now respect your configured threat model when selecting untrusted sources — which means they can include AI-sourced data if you’ve modeled it. But CodeQL ships no default models for OpenAI, Anthropic, or any other LLM client library. You write them yourself using data extensions.

Enable the threat model in your workflow first:

# .github/workflows/codeql.yml
- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: python
    config: |
      threat-models:
        - ai

Then create a data extension file that marks LLM response functions as AI sources. The kind: "ai" value is what links the source to your enabled threat model:

# .codeql/extensions/llm-sources.yml
extensions:
  - addsTo:
      pack: codeql/python-all
      extensible: sourceModel
    data:
      # OpenAI responses
      - ["openai", "ChatCompletion", false, "create", "", "", "ReturnValue", "ai", "manual"]
      # Anthropic responses
      - ["anthropic", "Anthropic", false, "messages.create", "", "", "ReturnValue", "ai", "manual"]

With that in place, any taint path from those return values to a dangerous sink (XML parser, NoSQL query, regex engine) will surface as a finding. This is especially relevant for retrieval-augmented generation (RAG) apps and agent workflows where LLM output gets parsed, stored, or executed downstream.

Breaking Change: Custom GitHub Actions Queries Will Fail

If you maintain custom CodeQL queries that target GitHub Actions workflow files, 2.27.3 breaks them. The Actions control flow graph now uses the shared CFG library, and the legacy Completion classes have been removed entirely.

The migration is mechanical — replace each Completion class with the equivalent CFG edge label:

// Before (broken in 2.27.3)
exists(Completion c | ...)

// After — use the appropriate edge label for the control flow type
exists(DirectSuccessor s | ...)
// or BooleanSuccessor, ReturnSuccessor depending on the edge type

If you only use GitHub’s standard query packs and haven’t written custom Actions queries, you’re not affected. But if you have a custom security policy with hand-rolled Actions analysis, audit it before upgrading.

Everything Else in 2.27.3

Python 3.15 support lands in this release. The extractor now handles unary plus in match literal patterns, Unicode 17 identifiers, and the new frozendict and sentinel builtins — including data flow modeling for frozendict construction. C23 also gets a nod with support for _BitInt(N) bit-precise integers. And data extension files now accept JSON syntax with the same structure as YAML, which is a quality-of-life improvement if your team prefers JSON in tooling configs.

CodeQL 2.27.4 Dropped the Next Day

GitHub released 2.27.4 on November 4 — one day later — with a batch of accuracy improvements. Java/Kotlin’s java/log-injection query now catches more sanitizers from Apache Commons Lang, Guava, OWASP Java Encoder, and Spring Framework. Rust sees false positive reductions in uncontrolled-allocation-size, log-injection, and cleartext-logging queries. C/C++ stops flagging intentional pointer arithmetic on std::byte* buffers. The CWE-730 tag was removed from regex-related queries across six languages — a metadata cleanup that tidies security reporting dashboards without affecting alert counts. Both releases ship in GHES 3.24.

AI Threat Model vs GitHub AI Scan: Use Both

GitHub also made AI Scan for pull requests generally available in October. These are different tools serving different needs: AI Scan uses an LLM to find vulnerabilities in languages CodeQL doesn’t cover (PHP, Bash, Terraform, Dockerfiles) and surfaces findings directly on PRs. CodeQL’s AI threat model is a static analysis configuration — it tracks data flow from AI-generated sources to known dangerous sinks across deep multi-step paths AI Scan won’t trace. AI Scan is advisory and can’t block merges; CodeQL can. Use both.

Who Should Update Now

If you have custom CodeQL queries for GitHub Actions, audit and migrate Completion classes before the upgrade — this is the only breaking change. If you run Python codebases with LLM integrations, 2.27.3 is the release to get: Python 3.15 support and the AI threat model are both here. If you’re on Java or Rust, 2.27.4 is worth taking for the reduced false positives. Full details in the official changelog.