SQL injection in agent / MCP tool database query
AI agents that build SQL queries from untrusted input can be tricked into running attacker-controlled database commands. The attacker can be a person typing directly to the agent, or hidden instructions planted in content the agent reads and treats as trustworthy.
How the attack works
An agent or connected tool takes text input and inserts it directly into a SQL query without validation. An attacker supplies input containing SQL syntax, such as a tautology that bypasses a filter, a UNION SELECT that pulls data from unrelated tables, or a stacked command that drops or deletes data. If the input comes from retrieved content rather than a direct message, this counts as indirect prompt injection: the agent processes the malicious instruction because it was embedded in a document, webpage, or file it fetched. The query executes with whatever database privileges the agent's connection holds, so the attacker gets read access, data exfiltration, or destructive changes depending on the payload.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c20613c0-65ae-4d81-b3e9-49eb79a06ddd
- Severity
- High
Why it matters
An organisation can lose confidentiality of database contents beyond what the agent was meant to expose, and can suffer data loss or corruption from destructive stacked queries. This is one narrow step in a larger attack chain, not a full account of how far an intruder could go afterward.
What you can do
- →Use parameterised queries or prepared statements in every agent/tool database integration; never concatenate raw input into SQL.
- →Run the agent's database connection with least-privilege credentials, separate from admin accounts, and disable multi-statement execution where possible.
- →Validate and sanitise any input that reaches a query builder, including content pulled from external documents or web pages the agent retrieves.
- →Review session logs for queries containing UNION, tautologies (e.g. OR 1=1), or stacked statements, especially when preceded by ingestion of external content.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.