SQL Injection via AI Agent Tools

AI agents with database access can become unwitting SQL injection vectors. An attacker does not need direct database access. They just need to influence the agent's input, and the agent constructs the malicious query on their behalf. This is one of the most concrete risks in agentic systems.

The Attack Vector

An agent with a "query database" tool takes natural language requests and translates them into SQL. If the agent generates SQL by string concatenation (or if the underlying tool does), user input flows directly into the query.

A user message like "Show me all users where name = 'admin'; DROP TABLE users; --'" might cause the agent to generate a query containing the injection payload. The agent does not understand SQL injection. It translates the user's intent into SQL, including the malicious parts.

Why Agents Make This Worse

Traditional SQL injection requires an attacker to find a vulnerable input field and craft a precise payload. With an agent intermediary, the attacker provides natural language that the agent helpfully converts into working SQL. The agent handles the technical details of crafting a syntactically valid query, lowering the skill barrier for attacks.

Defense Layers

Parameterized queries only. The database tool must use parameterized queries, never string concatenation. This eliminates SQL injection at the source regardless of what the agent generates.

Query validation. Before execution, parse the generated SQL and verify it matches expected patterns. Block queries containing DDL statements (DROP, ALTER, CREATE), multiple statements (semicolons), or UNION-based data extraction.

Read-only connections. If the agent only needs to read data, use a database connection with read-only permissions. Even a successful injection cannot modify or delete data.

Policy enforcement. Authensor's policy engine evaluates database tool calls before execution. Define policies that restrict which tables and operations the agent can access. A customer support agent should query the orders table but never touch the users or credentials tables.

Input scanning. Scan user messages for SQL keywords and patterns before they reach the agent. Authensor's Aegis scanner detects SQL injection patterns in natural language input.

Monitoring

Track which SQL queries the agent generates. Alert on queries that access unexpected tables, contain unusual patterns, or return unexpectedly large result sets. Authensor's audit trail records every database tool invocation with the generated query for forensic review.