AIDEFEND SecureFlow / SecureFlow Case Index

SSMS Copilot: Database Instructions Turn Read-Only Tools into SYSADMIN

• Autonomous Agents
• System Compromise & RCE
• Data Exfiltration

Johann Rehberger tested Copilot, the AI query assistant in SQL Server Management Studio (SSMS), and made a database owner's stored instructions induce execution under another user's more privileged SQL connection. A regex-based read-only check failed to contain dynamic SQL, and the final demonstration added the attacker's login to sysadmin. Separate direct-prompt experiments sent table data over SMB; these are distinct demonstrations, not evidence of a single observed intrusion.