Prompt Injection Enters the Security Toolkit as Agent Platforms Expand

Prompt Injection Meets CodeQL

Let’s begin where AI security is becoming ordinary application security.

On 10 July, GitHub said CodeQL 2.26.0 added a JavaScript and TypeScript query for detecting flows of untrusted data into AI system prompts. The query covers model APIs from OpenAI, Anthropic and Google.

Prompt injection happens when untrusted content influences a model’s instructions in ways the application developer did not intend. That content might arrive through user input, a retrieved document or another external source. In an agentic application, the consequences can extend beyond an unhelpful answer if the model can invoke tools or access sensitive information.

GitHub’s change brings part of that problem into static analysis: examining code for potentially dangerous data flows without running the application. Teams using CodeQL and GitHub code scanning may now be able to identify some risky patterns during development, alongside more conventional software vulnerabilities.

That shift is significant. Prompt injection is no longer confined to specialist AI-safety discussions; it is becoming a concern for application-security teams, code reviewers and continuous-integration pipelines. Earlier detection could give developers a chance to redesign trust boundaries before an application reaches production.

There are important limits to what can be concluded from the announcement. The briefing contains no independent assessment of the query’s coverage or false-positive rate. Static analysis also cannot settle every runtime question, particularly when model behaviour depends on dynamic context, retrieved content and tool permissions. Even so, incorporating prompt-injection detection into a familiar security workflow is a practical step towards treating AI applications like other production software.

OpenAI’s GPT-5.6 Family

That security backdrop leads directly into a larger generation of agent-focused models.

On 9 July, OpenAI announced three GPT-5.6 variants: the flagship model Sol, the balanced model Terra and the lower-cost model Luna. The company says the family is available through ChatGPT, Codex and its API.

The associated API capabilities are especially relevant for production agents. They include programmatic tool calling, persisted reasoning, explicit cache controls and beta multi-agent orchestration.

Programmatic tool calling lets software connect model decisions to defined actions. Persisted reasoning is intended to carry reasoning state across work rather than reconstructing everything from scratch. Explicit cache controls give developers more influence over reuse, latency and cost. Multi-agent orchestration provides a way to divide a task among specialised model-driven workers, although that capability remains in beta.

Taken together, the release concentrates several building blocks for agents inside one model platform. The practical attraction is less about a single chat response and more about systems that can perform longer jobs, use external capabilities and coordinate multiple streams of work.

It also increases the importance of operational discipline. More tools and more persistent state create more places where permissions, data handling and failure recovery need careful design. The CodeQL announcement is relevant here: as model platforms become better equipped to act, developers need security controls that can follow the path from untrusted input to model instructions and then into tools.

OpenAI’s benchmark, performance and cost-efficiency comparisons should be treated as company claims unless independently reproduced. The feature set is clear from the announcement; how Sol, Terra and Luna compare in real workloads will require outside testing.

A Bounty for Biological Safeguards

OpenAI is also inviting researchers to test a much higher-consequence boundary.

On 9 July, the company announced a private bug-bounty program focused on broadly applicable jailbreaks that can defeat biological-safety controls in its frontier models. The program begins with GPT-5.6, and OpenAI says the maximum reward has risen from US$25,000 to US$50,000.

A jailbreak is a technique that causes a model to bypass restrictions intended to prevent particular outputs. Here, the scope is not a one-off prompt that produces an isolated failure. OpenAI is seeking broadly applicable methods against safeguards designed for biological risk.

The approach borrows a familiar mechanism from cybersecurity: give external researchers structured access and pay them for reproducible vulnerabilities. Applied well, a bounty can bring more adversarial scrutiny to systems before weaknesses are widely exploited. It can also create a managed path for researchers to report serious findings.

Its value will depend on the details. Researcher access determines who can participate and which techniques get tested. Disclosure practices affect what the wider safety community can learn. Most importantly, a reported failure needs to produce a mitigation that remains effective against variations of the attack, rather than a narrow patch for one submitted example.

The higher maximum reward signals greater attention to the stakes, but the amount alone does not demonstrate that safeguards are robust. The meaningful evidence will be whether the program finds systemic weaknesses and whether those findings lead to durable improvements.

Grok 4.5 Targets Developers

Competition for coding and agent workloads is widening at the same time.

On 8 July, SpaceXAI announced Grok 4.5 for coding, agentic tasks and knowledge work. The company says it trained the model in collaboration with Cursor and launched it through Grok Build, Cursor and an API.

The Cursor connection gives Grok 4.5 an immediate route into an established coding environment. Distribution matters for developer models because adoption is shaped not only by benchmark results, but also by how easily a model fits into editing, review and agent workflows.

SpaceXAI reports generation speeds of up to 80 tokens per second. It also makes performance and token-efficiency comparisons. Those figures are vendor-reported and are not independently substantiated in the briefing.

The useful question is therefore how the model behaves in sustained work: navigating a real codebase, choosing appropriate tools, recovering after a mistaken change and completing tasks without excessive supervision. Speed can improve the experience, but fast generation is not the same as reliable engineering.

Independent testing will be needed to determine whether the claimed efficiency and agent performance hold up across varied repositories and development practices. For now, the concrete development is that another major model has entered coding workflows through both an API and a widely used environment.

Voice Without Strict Turn-Taking

Away from code, voice interfaces are becoming less rigidly conversational.

On 8 July, OpenAI introduced GPT-Live-1 and GPT-Live-1 mini. The company says the models can listen and speak simultaneously, an approach known as full-duplex operation.

Most voice assistants behave like a radio exchange: one side speaks, pauses and waits for the other. Full duplex is intended to support overlapping input and output, allowing a person to interrupt or clarify while the system is speaking. If it works consistently, that could make turn-taking feel more responsive and less mechanical.

OpenAI also says the live system can hand complex reasoning or web-search work to a frontier model while continuing the spoken interaction. That separation could let a voice layer remain engaged while a more capable model handles the difficult part in the background.

Potential applications include customer support, accessibility and hands-free work. A user might correct an assistant mid-sentence, ask it to pause or refine a request without restarting the whole exchange. Delegating harder tasks could also expand voice beyond simple commands.

The briefing contains no independent latency or reliability testing. Those details are crucial: poorly timed interruptions, delayed responses or incorrect assumptions about who is speaking can quickly undermine a voice experience. The announcement establishes the intended capabilities, while real-world testing will show whether they remain dependable in noisy, unpredictable conversations.

AWS Governs Claude Access

As assistants gain more agency, enterprises need a firmer control plane.

On 8 July, AWS announced Claude apps gateway, a self-hosted control layer for Claude Code and Claude Desktop. AWS says it provides centralised identity, model-access policies, tool permissions, spending controls and request routing.

The gateway can route inference through Amazon Bedrock or Claude Platform on AWS. In practical terms, it gives an organisation a central place to decide who may use these applications, which models they may reach, what tools they can invoke and how spending is constrained.

Those controls address a growing operational problem. A coding agent may interact with repositories, development tools and other internal systems. Managing each installation separately becomes difficult as usage spreads. Central policy can make permissions and costs more visible and consistent.

Self-hosting may also appeal to organisations that want the control layer within their own environment. But the announcement comes from AWS, and the briefing contains no evidence from customer deployments. We do not yet have independent detail on operating complexity, policy gaps or how the gateway performs at organisational scale.

Still, the product direction is telling. Enterprise adoption of agents is increasingly about governance as much as model capability. The systems that control identity, tools, routing and expenditure may become as consequential as the models sitting behind them.

Britain Proposes Cyber Shield

The same agentic logic is now appearing in national-security planning.

On 7 July, the UK National Cyber Security Centre and Department for Science, Innovation and Technology outlined Cyber Shield. It is a proposed sovereign system using frontier AI for defensive analysis, automated red-and-blue-team exercises and faster reduction of national cyber risk.

Red teams simulate attackers, while blue teams defend systems. Automating parts of both could allow defensive techniques to be tested repeatedly and at machine speed. A sovereign system would also place questions of control, infrastructure and national capability at the centre of the design.

The source describes an initiative and intended direction. It is not evidence that a complete operational system has already been deployed.

That distinction matters because agentic cyber defence carries substantial unresolved risks. Automated systems may process threats faster than human teams, but they can also make unreliable assessments, act on incomplete information or create escalation risks. Effective oversight would need to keep pace with the system’s speed and reach.

Other governments, including Australia’s, will likely watch the UK model closely. However, the verified packet provides no evidence of an Australian commitment, and no Australia-specific development has been added to this episode. For now, Cyber Shield is best understood as a statement of national direction rather than a demonstrated operational capability.

FTC Targets Misleading AI Claims

Finally, US regulators are testing how existing consumer law applies to AI behaviour.

On 7 July, the US Federal Trade Commission formally published a proposed policy statement concerning deceptive AI-accuracy claims. It applies the FTC Act’s prohibition on deceptive practices to AI providers that misrepresent system objectives or manipulate outputs contrary to reasonable expectations of accuracy.

The proposal frames model behaviour and claims about reliability as consumer-protection issues. A provider’s responsibility would not necessarily begin and end with whether an AI system can produce correct answers. Regulators may also examine how the system is optimised, what users are led to expect and whether outputs are manipulated in ways that conflict with those expectations.

For vendors, that could affect product descriptions, reliability claims, disclosures and user-interface design. Companies may need to be more precise about what a model is built to optimise and where its output can diverge from ordinary ideas of accuracy.

The proposal also raises questions about whether conflicting state AI requirements could be federally pre-empted. That could shape the balance between a national approach and separate state rules.

It remains a proposed policy statement, not a final rule. Its final wording and practical enforcement effects are therefore unsettled. Even at this stage, though, it shows regulators looking to established deception law rather than waiting for an entirely new legal framework for every AI-related problem.

Final Recap

Here’s the compact picture across these eight developments.

GitHub is bringing prompt-injection detection into CodeQL, placing an emerging AI vulnerability inside a conventional code-scanning workflow. OpenAI’s GPT-5.6 family combines tools, persisted reasoning, cache controls and beta multi-agent orchestration, while its new private bounty asks external researchers to find broadly applicable failures in biological-safety safeguards.

SpaceXAI is pushing Grok 4.5 into coding workflows through Cursor, Grok Build and an API, although its speed and efficiency claims still need independent testing. OpenAI’s GPT-Live models aim for simultaneous listening and speaking, with harder work delegated while the live exchange continues.

AWS is offering central governance for Claude applications, covering identity, model access, tool permissions, spending and routing. Britain has outlined an agentic cyber-defence initiative, but not a completed operational system. And the US FTC has proposed treating misleading AI objectives and accuracy representations as potential deceptive practices under existing law.

No qualifying major announcement dated 11–13 July appeared in the verified packet, and there was no sufficiently supported Australia-specific development. All direct sources are linked in the show notes.