SQL Copilot shows why an approval prompt cannot limit database access
A patched research case and current Microsoft guidance point to a concrete review: check the identity that actually executes the query.
2026-10-05 · 5 min · 4 sources
Johann Rehberger
x · Follow ↗
AI system security
Prompt injection, agent security, data exfiltration and disclosures
- Type
- Security researcher
- Priority
- Tier 1 · core
- Perspective
- Offensive AI security
- Best for
- Vulnerability demonstrations and mitigations
- Publishes
- Frequent
- Editor's note
- Coordinate disclosures and verify affected versions.
Our analysis featuring Johann Rehberger
Recent from Johann Rehberger
- Video 🍿 🔥 From SELECT to SYSADMIN 🔥 Hijacking Copilot in SQL Server Management Studio (CVE- 2026 2026-10-05
- I talked about this back 6 years ago in my machine learning attack series. Back then I called it a 2026-10-01
- AI companies agreed to have internal red teams. 👀 👍 Hope we'll see posts from them and findings go 2026-10-01
- NeurIPS 2026! Let’s go!! 🚀🚀 Very excited that our work on "Agent Security is a Systems Problem" was 2026-10-01
- If your Dot goes off script and the system notices it might be a bit misaligned, you can: 1. Procee 2026-10-01
- From SELECT to SYSADMIN 🔥 Happy to share my research on the Microsoft AI database assistant in SQL 2026-09-30