AI Text-to-SQL Injection — Prompt to Database
DataPilot turns plain-English questions into SQL for shop owners. It's meant to query only your shop's orders and products — but the agent runs whatever SQL your request implies against a replica that holds every table, including platform secrets.
What is text-to-SQL injection?
Text-to-SQL features turn a plain-English question into a database query. The model writes the SQL and the application runs it.
Text-to-SQL injection is asking in a way that makes the model write a query beyond what the user is allowed to see: other customers' rows, other tables or a different operation altogether. No SQL knowledge is needed, since the attack is written in ordinary language.
A real case
Researchers showed a Cursor agent connected to Supabase with the service-role key reading a customer support ticket that contained instructions. The agent ran SQL with its own full privileges and wrote private integration tokens back into the ticket thread, where the attacker could read them.
This lab has the same structure: a model writes the SQL, the database runs it with broad rights, and plain language decides what the query does.
Source: Simon Willison
How to fix it
- Run generated queries under a database account that can see only the current user's data.
- Use row-level security and read-only access.
- Parse the generated SQL and allow only single SELECT statements on approved tables.
- Do not rely on a prompt rule to keep queries within scope.
Questions people ask
How is this different from classic SQL injection?
Classic injection breaks out of a query the developer wrote. Here the model writes the whole query, and the attacker influences it through language.
Do parameterised queries help?
They do not apply in the usual way, because the query structure itself comes from the model. Database permissions are the main control.
What is row-level security?
A database feature that limits which rows each user can read, enforced by the database whatever query is sent.
Read the full OWASP LLM Top 10 guide · All free labs · AI red team certification