AIDEFEND in Action AIA-0099 Validated Research Published: Oct 23, 2026

SSMS Copilot: Database Instructions Turn Read-Only Tools into SYSADMIN

Johann Rehberger tested Copilot, the AI query assistant in SQL Server Management Studio (SSMS), and made a database owner's stored instructions induce execution under another user's more privileged SQL connection. A regex-based read-only check failed to contain dynamic SQL, and the final demonstration added the attacker's login to sysadmin. Separate direct-prompt experiments sent table data over SMB; these are distinct demonstrations, not evidence of a single observed intrusion.

Indirect Prompt InjectionConfiguration PoisoningTool AuthorizationAI Infrastructure
5 applicable AIDEFEND defenses
Source: From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669) 
Author: Johann Rehberger
Original article: Sep 30, 2026

Threat Analysis

The attack crosses two boundaries. First, a database owner controls instructions that Copilot later reads as database metadata. Second, a supposedly read-only tool submits SQL using the victim's authenticated connection. An attacker with ALTER permission on one object can write its AGENTS.md property, but the final server-level escalation demonstration used db_owner control of the database constitution. Those privileges must not be reduced to an unauthenticated attack.

ReadFromDatabase classified SQL using regular expressions. Calling EXEC through a variable allowed dynamic SQL to evade that classifier. Copilot then executed with the connection's existing permissions. In the final test, that authority was sufficient to grant the attacker's login membership in sysadmin. Separately, directly prompted ReadFromDatabase and RestoreVerifyBackupFile tests demonstrated arbitrary SQL and table-row exfiltration through SMB. The flow preserves the backup demonstration separately rather than presenting exfiltration as a proven sequel to the escalation.

The vulnerability identifier CVE-2026-65669 covers SSMS 22.0 inclusive to 22.8.2 exclusive in Microsoft's record. Version 22.8.2 was released July 28; the CVE was published September 8. The research is controlled validation, not evidence of exploitation against an operational victim.

Microsoft documents agentExecuteAsUser in CONSTITUTION.md, implemented with EXECUTE AS. A missing IMPERSONATE grant fails execution, but an absent constitution reverts to the connected user. Because the threat includes an attacker who controls that metadata, this setting cannot be the sole boundary protecting an administrator connection.

Applicable AIDEFEND Defenses (5)

AID-H-017.002
Least-Privilege Tool Architecture
Very High
Use a dedicated SQL connection whose server-enforced permissions permit only the exact read operations the task needs. Deny role membership changes, dangerous stored procedures and impersonation of privileged principals; test those denials using the actual Copilot connection. G001's typed, single-purpose-tool architecture and backend read-only role apply here; its PostgreSQL example requires a SQL Server-specific implementation. agentExecuteAsUser alone is insufficient when the attacking db_owner can replace or remove the constitution and restore the connected login's authority. Expose only a narrowly typed backup-verification operation and execute it under a principal lacking arbitrary SQL, privilege changes and outbound-file capabilities. In unmodified SSMS, the immediately deployable part is a genuinely low-privilege connection or disabling Copilot; replacing the built-in tool requires vendor or controlled-client work. Verify that both the backup and database-reading tool paths fail against disallowed operations.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
Very High
Inventory the SSMS binaries actually launched, identify affected versions from the Microsoft CNA record, deploy 22.8.2 or a later supported fixed build, and verify the running version plus negative SQL-bypass tests. A downloaded installer is not fleet completion. If a host cannot be updated, disable Copilot through managed controls until the exposure is removed; that compensating state needs its own readback.
AID-H-004.001
User & Privileged Access Management
High
Stop routine SSMS work from running on a login that holds sysadmin. Give the administrators who use Copilot a standing low-privilege login, and make server-level elevation a separate, time-bound, justified session through PAM or just-in-time role assignment, with Copilot agent mode left off in that elevated session. Recertify who holds sysadmin and db_owner, since the demonstrated escalation needs a victim connection able to grant that role; if no everyday connection carries it, injected SQL executes with far less authority. This governs the human identity; the tool's own connection boundary is AID-H-017.002.
AID-H-021.003
Agent Context Source & Configuration Governance
Medium
Treat CONSTITUTION.md and AGENTS.md extended properties as governed agent context sources, not incidental documentation. Keep a manifest of every database and object that is allowed to carry Copilot instructions, with an owner, trust tier and approved content, and reconcile it in both directions against the extended properties actually present so an unlisted or changed instruction surfaces as a finding. Pair it with the permission review: only named owners should hold ALTER or db_owner rights that can write these properties. This narrows who can plant instructions and makes stray ones visible; it does not stop a legitimate db_owner from writing one, so the execution boundary in AID-H-017.002 remains decisive.
AID-D-004.003
Runtime Configuration & Policy Drift Detection and Monitoring
Medium
Detect changes to Copilot's database-side configuration as they happen. Compare the live CONSTITUTION.md and AGENTS.md extended properties with the approved state on a schedule, and have SQL Server Audit or a DDL trigger record every sp_addextendedproperty or sp_updateextendedproperty call against them, with the principal, time and new value, so a planted instruction raises a finding before the next administrator session reads it. The published howTos are GitOps and Kubernetes examples; this needs a SQL Server-specific implementation. It is detection, not prevention, and it only helps if someone reviews the finding before the victim connection executes.

What Defenders Should Do Now

  • Inventory the SSMS version actually launched. Upgrade affected installations to a supported fixed build, verify the running version, and repeat negative tests for the database and backup tool paths. Disable Copilot through managed controls on hosts awaiting remediation.
  • Use a dedicated low-privilege SQL connection for Copilot. Test denied role grants, impersonation, dynamic SQL side effects and dangerous stored procedures with that exact principal; do not rely on the model's read-only statement.
  • Review who can change database-wide CONSTITUTION.md and object-level AGENTS.md properties. Keep an owner-and-approved-content manifest of every database allowed to carry them, reconcile it against the live extended properties, and audit sp_addextendedproperty and sp_updateextendedproperty calls so a planted instruction is seen before the next administrator session. Keep the actual login low privilege even if agentExecuteAsUser is configured, and test behavior after metadata removal.
  • Take sysadmin off the logins people use for everyday SSMS work. Route server-level elevation through PAM or just-in-time role assignment in a separate session with Copilot agent mode off, and recertify sysadmin and db_owner membership.
  • Push Copilot settings centrally with group policy or Intune: turn off agent mode or Copilot where tool execution is not needed, and alert when a host drifts from the approved configuration.
  • At the SQL Server host, restrict outbound SMB to the exact destinations needed by the service. Confirm the actual server route is blocked; restricting the desktop's browser traffic does not cover this path.

Conclusion

AIDEFEND  maps this case to narrowly scoped tools backed by real database permissions, verified remediation of the vulnerable SSMS build, privileged-access management for the humans who run Copilot, centrally enforced client configuration, and governance plus change detection for the database-side instructions Copilot reads. The decisive boundary is the SQL principal that actually executes the command: metadata instructions and a read-only classifier must not inherit a human administrator's authority.

Last updated: