Model output run as raw SQL (LLM-authored query executed unparameterized)
Part of the AI app safety check · fix arrives as a pull request
What it is
A query string produced by the model is passed to the database driver and executed. The model authors the SQL, and nothing between it and the database validates the shape of what it wrote.
Why it matters
The model has become the injection vector. It runs at whatever privilege your connection holds, so a prompt-injected or simply hallucinated DELETE executes exactly as written, and no parameterisation exists to stop it.
How to fix it
Do not execute model-authored SQL. Have the model choose from named, parameterised queries you wrote, or emit structured arguments you bind yourself. If free-form querying is genuinely required, run it through a read-only role on a replica with a statement timeout.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.