# Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Language

- **Severity:** High
- **Signature ID:** `21678549-f5f7-4d8b-8e71-003e59285a04`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM08 (Vector and Embedding Weaknesses)

## Summary

Instead of using SQL injection syntax, an attacker just asks an AI agent in plain English to 'drop all tables' or 'show all records for all users.' If the agent has database tool access and doesn't check scope, it can carry out the request literally, causing mass data loss or mass data exposure.

## How the attack works

An attacker sends a natural-language instruction to an agent that has database or tool access. The instruction asks for a broad, unqualified action -- delete everything, show every record, insert data into 'the most appropriate table' -- without naming any specific table, schema, or record. The agent translates this vague intent into an actual destructive or bulk-disclosure database call. No SQL injection syntax is used at all; the attack relies entirely on the agent's own tool-calling ability to turn plain words into a broad, unscoped action.

## Why it matters

An organization can lose entire datasets to deletion or have all user records exposed in one action, triggered by a single unscoped sentence rather than a technical exploit.

## What you can do

- Require agents to reject or ask for confirmation on database instructions that lack a specific, named table, schema, or record scope.
- Enforce least-privilege database credentials for agents so no single tool call can affect all tables or all users.
- Log and review agent-issued database operations, flagging ones with broad qualifiers like 'all', 'every', or 'most appropriate'.
- Add scope-validation logic between the agent and the database layer so destructive or bulk-read operations require an explicit allowlisted target.

## Known benign look-alikes

- A developer or DBA giving a specific, scoped instruction naming an actual table/database ('drop the temp_orders table in staging')
- Documentation or tutorials explaining general database concepts without directing an agent's tool to act
- A legitimate data-export request scoped to a named report or a single user's own account, not 'all users'
- A request that says 'all tables/databases' but explicitly scopes the whole request to a non-production environment -- 'Truncate all tables in the test database before running the integration suite', 'Please drop all tables in the dev schema and recreate them for the new test run' -- must not fire, as long as the request does not ALSO reference production/live data anywhere

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02233

---
Source: https://www.netzilo.com/threats/atr-unscoped-destructive-or-mass-disclosure-database-operation-r