# SQL Injection Destructive DDL Statement

- **Severity:** Critical
- **Signature ID:** `f7e795cb-b503-48a6-a479-cb9779f9a8e4`
- **MITRE ATLAS:** AML.T0043 (Craft Adversarial Data)
- **OWASP:** ASI03 (Identity and Impersonation), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers can trick an AI agent into running destructive database commands by hiding them inside text the agent passes to a database tool. This can wipe out entire tables or delete all rows in a table, with no way to undo the damage.

## How the attack works

The agent accepts input from a user or an external source and forwards it into a database query tool without properly separating data from commands. The attacker crafts input that closes out the expected string value early using a quote character followed by a semicolon, then appends a second, malicious SQL statement. That second statement is a destructive one: DROP TABLE, TRUNCATE TABLE, or a DELETE FROM with no WHERE clause limiting its scope. Because the agent executes the combined text as SQL, the database runs the attacker's statement along with the intended one.

## Why it matters

Successful exploitation permanently destroys tables or wipes all rows in them, causing irreversible data loss and potential service outage for anything relying on that data.

## What you can do

- Never build SQL queries by concatenating raw user or agent input; use parameterized queries or prepared statements exclusively.
- Restrict the database credentials used by agent tools to the minimum permissions needed, denying DROP, TRUNCATE, and unrestricted DELETE unless explicitly required.
- Validate and sanitize any input that reaches a database tool, rejecting values containing unexpected quote characters or statement terminators.
- Review logs for DDL statements or unbounded DELETEs originating from agent tool calls, and alert on any such activity outside known maintenance windows.

## Known benign look-alikes

- Database administrator agents with explicitly granted DDL permissions
- Schema migration agents running authorized DROP/TRUNCATE operations

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01601

---
Source: https://www.netzilo.com/threats/atr-sql-injection-destructive-ddl-statement