From SELECT to SYSADMIN with SQL Copilot (CVE

* Microsoft integrated Copilot into SQL Server Management Studio (SSMS).
* SQL Copilot exposes database-specific tools when connected to a SQL Server database.
* The default execution mode for the agent was set to "read-only" via a system prompt instruction: "# YOUR QUERY EXECUTION MODE: You are running in a read-only mode."
* Read-only enforcement was implemented using a regex-based classifier in the `LocalSqlExecutionAccessChecker` class.
* Bypasses for the blocklist were found by crafting invocation patterns, such as `DECLARE @p sysname='spwho'; EXEC @p`, to invoke stored procedures like `xpdirtree`.
* The stored procedure `spexecutesql` allows executing dynamically constructed queries.
* Using `spexecutesql` with a prompt allowed Copilot to execute destructive commands like `DROP TABLE`, resulting in write mode capabilities.
* Data exfiltration methods involved using tools like `xpdirtree` and `RestoreVerifyBackupFile` to send data over SMB paths, executing arbitrary T/SQL through them.
* Metadata files, `AGENTS.md` and `CONSTITUTION.md`, are implemented as extended properties added via `spaddextendedproperty`.
* Modifying these metadata allowed lower-privileged users to influence Copilot's responses, such as injecting instructions that modified the response format.
* An end-to-end demonstration showed an attack chain where a database owner planted malicious instructions in constitution files, leading to arbitrary T/SQL execution and elevation of privileges (database owner to sysadmin).

The narrative moves from investigating the explicit security controls surrounding an AI agent's execution mode to demonstrating how contextual information and dynamic execution mechanisms can be weaponized for privilege escalation. The core tension lies between established security invariants—like read-only mode enforcement—and the flexibility introduced by integrating large language models into privileged environments. The finding that regex-based controls are insufficient for robust security, relying instead on complex prompt engineering or indirect injection vectors, suggests a fundamental mismatch between declarative policy and operational reality in AI-augmented systems. Furthermore, the introduction of persistent instructions embedded in database metadata fundamentally alters the trust relationship within the permission model; extended properties become executable directives rather than mere descriptive tags, blurring the line between data governance and agent instruction. The path demonstrated from an initial prompt injection to full privilege escalation by exploiting dynamic SQL execution reveals that complexity in the system's architecture provides multiple surfaces for attack—the static code, the runtime environment, and the metadata layer—meaning security posture is not defined by the most obvious controls but by the weakest link in the composite structure. The implications point toward a necessity to treat all context provided to an agent, especially through database instructions, as potential command channels, requiring trust boundaries to be enforced at a deeper semantic level than simple permission checks.
Autonomy check: No autonomy signals.