As a workaround you can run
set define off
in your worksheet.
Previous version did not do that. I'm assuming it's a bug. Not critical for me, but would like it fixed as I have lots of SQLs with comments that have & in them.
I doubt its a bug, but just more of integrating SQL*Plus functionality into SQL Developer. As dagtech showed, you can set DEFINE off. You can also change it from the default character of '&' to something else:
set define #
But then Murphy's Law will get you again and you'll have the '#' character in your comments too. Or whatever char you choose.
You can put this in a login.sql script which you can then change the SQL Dev preferences to execute on connect.
It is true that this is a regression from the behavior you would like to see, the behavior last seen in 4.0.3. The 4.1.0 release had a bug in this area, which resulted in the "Substitution cancelled" message instead. The behavior now seen in 4.1.1, prompting for a substitution variable even though the ampersand is embedded in a comment, merely works the same as in SQL*Plus, as implied by BPeaslandDBA in the post above.
Since this behavior is consistently the same in the latest SQLcl early adopter version and in our main SQL Developer code line, and matches SQL*Plus functionality, I would hesitate to log a bug. Perhaps this could be handled as an enhancement request for a future release.
Edit: Jeff beat me to the punch.