SQL Copilot prompt-only guardrails bypassed: EXEC via variable escalates from SELECT to SYSADMIN
wunderwuzzi23 · x · 2026-10-09
Researcher wunderwuzzi (Johann Rehberger) presents BlueHat Asia research on Microsoft's SQL Copilot in SSMS: its read-only behavior relied on system prompt plus a regex blocklist, and calling EXEC through a variable bypassed both, enabling elevation from SELECT to SYSADMIN. Key lesson: only permissions (not prompts) enforce read-only — if the connection can write, the agent can write. Microsoft patched quickly; he also proposes a database "CONSTITUTION.md" concept. Blog includes full technical details and video demos.
More from coding & agent
- Watch Claude build a GTA clone in hours: video shows how the AI iterates and debugs on its own — Daniel_Farinax · 2026-10-10
- dotConferences talk: how speculative decoding speeds up llama.cpp — ngxson · 2026-10-10
- Developer ships first App Store app Save4Two built with Cursor and Grok — chrisfleck · 2026-10-10
- Dev clones Photoshop and the whole Adobe suite in Rust using Claude — iamfakhrealam · 2026-10-10
- When AI Writes the Code, What Replaces Design Patterns? — JnBrymn · 2026-10-10
- Google Cloud launches App Optimize remote MCP server to query cloud costs from any AI assistant — rseroter · 2026-10-10