Neuron MySQLWriteTool Destructive SQL Execution

How the attack works

An attacker plants instructions in content the AI agent reads, either directly in a prompt or indirectly through a document, webpage, or other data the agent processes. The agent's SQL write tool (such as Neuron PHP framework's MySQLWriteTool, version 2.8.11 or earlier) passes whatever string the model produces directly to the database with no filtering. If that string contains a destructive or privilege-altering command, such as DROP TABLE, TRUNCATE, DELETE FROM with no filter, GRANT/REVOKE, or a second statement stacked after a semicolon, it executes against the production database as-is. The rule catches the moment this dangerous statement is handed to the tool, not the earlier injection that caused it.

Netzilo detection

Why it matters

Successful exploitation can destroy tables, databases, or user accounts, wipe data with unfiltered deletes, escalate database privileges, or exfiltrate data via file-write commands like INTO OUTFILE. Because the tool has no semantic restriction on what it executes, the damage can extend beyond the original intent of the agent's task.

What you can do

• →Never let an AI agent's SQL tool execute arbitrary model-generated statements against a production database; use parameterized, allow-listed operations instead of free-form SQL.
• →Restrict the database credentials used by write tools to only the specific tables and operations the agent actually needs, and remove DROP/ALTER/GRANT privileges entirely.
• →Require human approval or a secondary validation step before any destructive or schema-altering statement is executed by an agent.
• →Review flagged events against your own baseline: legitimate migration, ETL, or test-teardown agents may trigger this on non-transient table names, so confirm the destination database and table naming before treating every match as an incident.

Known benign look-alikes

• Schema-migration agents legitimately running DROP TABLE / ALTER TABLE ... DROP COLUMN against a development or staging database where the object is not named tmp/temp/staging.
• ETL or reporting pipelines truncating a rebuild table whose name does not carry a transient prefix (e.g. TRUNCATE TABLE daily_rollup).
• Test-harness agents tearing down fixture schemas at the end of a run.
• DBA-assistant workflows performing approved user administration (CREATE USER, GRANT ... ON, FLUSH PRIVILEGES) through a SQL write tool.
• Bulk-purge jobs issuing DELETE FROM <table> with no WHERE clause by design (log rotation, queue drain).
• Incident-response or code-review payloads that embed destructive DDL examples and are routed through a write tool; largely suppressed by filter_advisory_text and filter_placeholder_target.

References

• https://atlas.mitre.org/techniques/AML.T0051
• https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• https://attack.mitre.org/techniques/T1485/
• https://attack.mitre.org/techniques/T1565/001/

Related threats