SQL hidden in a string literal bypasses LLM-to-SQL gates; schemagate 1.15.1 fixes it
Temporary_Papaya1058 · reddit · 2026-10-29
Security researcher Artur Chlebicki reported a bypass in schemagate, an open-source access layer for text-to-SQL agents: an outer query names no table, hiding the real query inside a string literal passed to a function that executes SQL server-side, e.g. Postgres querytoxml('SELECT FROM hrcompensation', ...). A gate that checks "which tables does this SQL touch?" sees nothing and lets it run. The same hole exists in Oracle (DBMSXMLGEN.GETXML) and SQL Server (OPENQUERY/spexecutesql).
The 1.15.1 fix refuses functions that run SQL from a string (Postgres toxml/dblink, Oracle DBMS/UTL, SQL Server OPENROWSET/xp, Snowflake IDENTIFIER(), etc.), and as a backstop rejects any string argument that looks like a query naming a hidden table; 31 new tests were added, 23 of which fail on 1.15.0. Still open: strings built via concatenation and passed to unlisted functions can get through; parser-level gating only narrows the risk—read-only DB grants are what actually lock it down. If you build such a gate yourself, test it against SQL hidden inside strings.
More from coding & agent
- Google Gemini rolls out a central hub for custom skills and connected apps — sysrpl · 2026-10-29
- New Prompt Optimization Beats GEPA by ~14% and Estimates Performance Bounds — sanmikoyejo · 2026-10-29
- New Chinese book 'Codex: From Beginner to Master' targets hands-on Codex learners — lxfater · 2026-10-29
- SJTU's TAO Cuts LLM Agent Serving Latency Up to 26.8% With Tool-Aware Joint Scheduling — AIOR-Research · 2026-10-29
- Monopoly game fully written by Claude in a single day — sysrpl · 2026-10-29
- Apple Paper: Tool-Use Agents Gain More From Data Diversity Than More Tasks — rohanpaul_ai · 2026-10-29