How the attack works
An attacker crafts a tool argument or message that includes a SQL condition designed to always be true, such as "OR 1=1", "OR true", or "OR 'a'='a'". The AI agent forwards this value into a database query without sanitizing it. The tautology overrides the intended WHERE clause, including any row-level security or role-based access filter. The query then returns all matching records regardless of the requesting user's actual permissions.
Why it matters
An attacker with low-privilege access to the agent can retrieve data belonging to other users or tenants, breaking row-level and object-level access controls and exposing sensitive records they were never authorized to see.
What you can do
- Never build SQL queries by concatenating raw user or agent input; use parameterized queries or prepared statements everywhere.
- Enforce authorization checks at the database or application layer independently of query text, so a malformed WHERE clause cannot widen access.
- Validate and reject tool arguments that contain SQL syntax when the field is expected to be a plain value like an ID or name.
- Log and review agent tool calls that pass suspicious boolean or SQL-like patterns as arguments, distinguishing them from legitimate documentation or code snippets.
Known benign look-alikes
- SQL queries in documentation or educational context (narrative text without tool_args)
- Boolean logic expressions in non-SQL programming contexts