SQL Injection UNION SELECT Data Exfiltration
Attackers hide a UNION SELECT statement inside text an AI agent passes along to a database query. If the agent's backend doesn't sanitize inputs, this appends a second query that pulls data from unrelated tables, like passwords or personal records, into the results the attacker sees.
How the attack works
The attacker sends the AI agent a search or filter request containing a crafted string, such as a product name field ending in a UNION SELECT clause. The agent forwards this text into a SQL query without escaping or parameterizing it. The database executes both the original query and the attacker's appended SELECT statement, combining the results. The attacker receives the combined output, which can include rows from tables they were never meant to access, such as user credentials or financial records.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9b6fd0df-371e-429c-8ac5-21408e72b0bd
- Severity
- Critical
Why it matters
An organization can lose sensitive data stored in its database, including credentials, personal information, and financial records, without any direct database access, just by talking to the AI agent.
What you can do
- →Never build SQL queries by concatenating agent-forwarded text; use parameterized queries or prepared statements everywhere.
- →Apply least-privilege database accounts for agents so even a successful injection can only read tables it legitimately needs.
- →Validate and constrain the structure of inputs the agent passes to database calls (e.g., reject unexpected keywords like UNION, SELECT, or statement terminators in fields that should be simple values).
- →Review any agent explicitly authorized to run multi-table UNION queries and confirm that authorization is still needed and scoped tightly.
Known benign look-alikes
- Database reporting agents explicitly authorised to run multi-table UNION queries