# SQL Injection via Natural Language Agent Interface

- **Severity:** High
- **Signature ID:** `d88e6b2b-92dc-4128-8f91-9fbd00511caf`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

Some AI agents translate user requests written in everyday language into database queries. This rule flags when someone tries to smuggle SQL injection payloads or manipulate that translation step through plain-English requests, instead of typing raw SQL.

## How the attack works

An attacker interacts with an AI agent that converts natural language into SQL queries against a backend database. They either embed classic SQL injection syntax directly in their message (DROP, DELETE, UNION SELECT, tautologies like OR 1=1, comment terminators, xp_cmdshell calls, or information_schema probing) or phrase the request conversationally, asking the agent to 'ignore the filter' or 'bypass the access control' or return results 'regardless of department or role.' Either approach aims to get the agent to build and run a query that returns or modifies data outside the user's intended scope. Because the agent trusts the natural-language instruction as intent, it may generate a query that honors the injected logic rather than the original restriction.

## Why it matters

Successful injection can expose, modify, or delete data the user should not have access to, and bypass row-level or role-based access controls enforced only at the query-generation layer.

## What you can do

- Never let an AI agent build SQL directly from user text; require parameterized queries or an intermediate query-validation layer.
- Enforce access control and row-level security at the database layer, not just in the agent's prompt or logic, so a bypassed filter still can't return unauthorized rows.
- Log and review agent-generated SQL queries, especially any containing DDL/DML keywords, UNION SELECT, comment terminators, or schema-discovery patterns.
- Treat natural-language phrases like 'ignore the filter' or 'regardless of role' as suspicious in any pipeline that turns text into database queries, and add explicit checks for them before query execution.

## Known benign look-alikes

- Security education or tutorial content that includes UNION SELECT or xp_cmdshell as examples
- Legitimate OR field=value clauses without numeric tautology (e.g. OR status = 'active' does not trigger)
- SQL in markdown code fences preceded by double-quotes or inline code backticks rather than single-quotes/semicolons
- Technical discussions about database access control in legitimate business context

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00522

---
Source: https://www.netzilo.com/threats/atr-sql-injection-via-natural-language-agent-interface