title: SQL Injection UNION SELECT Data Exfiltration
id: ATR-2026-01602
rule_version: 1
status: experimental
description: |
  Detects UNION SELECT injection in agent tool arguments intended to append
  a second SELECT statement to the original query, exfiltrating data from
  other tables (e.g., credentials, PII, financial records) alongside the
  normal result set. This is the primary SQL exfiltration technique targeting
  AI agents that forward search/filter inputs to SQL queries without
  parameterization.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
  mitre_attack:
    - T1190 - Exploit Public-Facing Application
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: UNION SELECT injection directly exfiltrates sensitive table data including credentials and PII.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Runtime detection of UNION SELECT injection supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: UNION injection is an adversarial input that circumvents access controls; Article 15 robustness requirements mandate detection.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must reject agent SQL inputs containing UNION SELECT clauses that append attacker-chosen result sets to exfiltrate credentials and PII from other tables.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting UNION-SELECT injection that directly exfiltrates sensitive table data is such a treatment.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: sql-injection
  scan_target: tool_args
  confidence: high
  suppress_in_code_blocks: true
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)(?:['"`)]\s*|\b\d+\s+)UNION\s+(?:ALL\s+)?SELECT\b|\bUNION\s+(?:ALL\s+)?SELECT\b[^;]{0,200}\bFROM\b
      description: UNION SELECT injection (quote/operand break or table-targeting FROM)
    - field: user_input
      operator: regex
      value: (?i)(?:['"`)]\s*|\b\d+\s+)UNION\s+(?:ALL\s+)?SELECT\b|\bUNION\s+(?:ALL\s+)?SELECT\b[^;]{0,200}\bFROM\b
      description: UNION SELECT injection in user input (quote/operand break or table-targeting FROM)
  condition: any
  false_positives:
    - Database reporting agents explicitly authorised to run multi-table UNION queries
response:
  actions:
    - block_tool
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01602] SQL UNION SELECT injection detected. Possible
    cross-table data exfiltration attempt. Tool call blocked.
confidence: 93