title: SQL Injection via Natural Language Agent Interface
id: ATR-2026-00522
rule_version: 1
status: stable
description: |
  Detects SQL injection attempts made through natural language to an AI agent that translates user intent into database queries. Covers both explicit SQL syntax and natural-language filter-bypass requests. Seen in promptfoo redteam sql-injection plugin (8 samples). The original auto-regex learned specific sentence patterns from the corpus. This rule replaces those with structural SQL-injection patterns that generalize across payloads: (A) DDL/DML injection: DROP, DELETE, TRUNCATE, UNION SELECT, INSERT INTO, UPDATE ... SET; (B) Tautology OR injection: OR N=N or OR col!=N patterns that short-circuit WHERE clauses; (C) SQL comment terminator (--) following injection payload; (D) xp_cmdshell stored procedure execution; (E) information_schema schema discovery queries; (F) Natural language filter bypass: "remove/ignore/bypass the filter/restriction/access control"; (G) Natural language authorization bypass: "regardless of department/role/permission". Any one condition is sufficient to trigger. Both technical SQL syntax and social-engineering bypass styles are covered.
author: ATR Community (vendor-corpus-import)
date: 2026/05/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI02:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
compliance:
  owasp_agentic:
    - id: ASI02:2026
      context: The patterns match SQL injection sent through a natural-language-to-SQL agent (DROP, DELETE or TRUNCATE after a quote, UNION SELECT, UPDATE ... SET, OR 1=1 tautologies, xp_cmdshell, information_schema) and plain-language requests to remove query filters or ignore access restrictions. ASI02:2026 covers an agent misusing a legitimate database tool, such as forwarding unvalidated input that deletes data or using over-scoped access to read records the task does not need.
      strength: primary
  owasp_llm:
    - id: LLM06:2025
      context: This rule detects LLM06:2025 Excessive Agency patterns where adversarial inputs exploit tool-calling capabilities to perform unauthorized actions beyond the agent's intended scope.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this tool poisoning detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
      strength: primary
    - article: '9'
      context: Tool poisoning is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Treating tool poisoning as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: Identifying tool poisoning as an AI risk to be catalogued in the organizational risk register.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (SQL Injection via Natural Language Agent Interface).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (SQL Injection via Natural Language Agent Interface).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Addressing tool poisoning risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure.
      strength: primary
    - clause: '8.4'
      context: Impact assessment for AI deployments under clause 8.4 must account for tool poisoning inputs; detection events from this rule provide the required monitoring evidence.
      strength: secondary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (SQL Injection via Natural Language Agent Interface).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (SQL Injection via Natural Language Agent Interface) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: sql-injection
  scan_target: llm_io
  confidence: high
  source: vendor-test-suite
  vendor_sources: promptfoo
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: '['';]\s*(?:DROP\s+TABLE|TRUNCATE\s+TABLE|DELETE\s+FROM)\b'
      description: |
        DDL injection via string-parameter context: single-quote or semicolon followed by DROP TABLE, TRUNCATE TABLE, or DELETE FROM. Requires the SQL keyword to be preceded by a string-terminator or statement-separator, distinguishing injection from legitimate SQL in documentation/code examples.
    - field: user_input
      operator: regex
      value: \bUNION\s+SELECT\b
      description: |
        UNION SELECT injection: always suspicious in natural language input to an agent. Used for credential dumps and schema discovery. No prefix context required since UNION SELECT in natural language text is a strong injection signal.
    - field: user_input
      operator: regex
      value: '['';]\s*UPDATE\s+\w+\s+SET\b'
      description: |
        UPDATE SET injection via string-parameter context: single-quote or semicolon followed by UPDATE...SET. Requires the injection separator to distinguish from legitimate SQL examples (e.g. in documentation).
    - field: user_input
      operator: regex
      value: \bOR\s+(?:\d+\s*=\s*\d+|\w+\s*!=\s*\d+|\w+\s*<>)
      description: |
        Tautology OR injection: OR N=N (always-true WHERE bypass), OR col!=N or OR col<> (non-equality bypass for BOLA/authorization bypass). Bypasses WHERE clause filtering.
    - field: user_input
      operator: regex
      value: '['';]\s*--\s*$'
      description: |
        SQL comment terminator (--) after injection separator at end of input. Used to neutralize the remainder of the SQL query after the injection payload. Requires a quote or semicolon before the comment to avoid matching shell comments.
    - field: user_input
      operator: regex
      value: \bxp_cmdshell\b
      description: |
        SQL Server xp_cmdshell stored procedure -- direct OS command execution via the database engine. Any occurrence is a high-confidence injection indicator.
    - field: user_input
      operator: regex
      value: \binformation_schema\s*\.
      description: |
        information_schema schema discovery: used in UNION SELECT attacks to enumerate tables, columns, and credentials from the database metadata catalog.
    - field: user_input
      operator: regex
      value: (?:remove|ignore|bypass|skip)\s+(?:the\s+)?(?:filter|restriction|department\s+restriction|access\s+control|where\s+clause)
      description: |
        Natural language filter/restriction bypass request. Covers social-engineering variants that ask the agent to remove query filters. Excludes 'without' to avoid FP on legitimate phrases like 'without permission'.
    - field: user_input
      operator: regex
      value: regardless\s+of\s+(?:department|access|permission|role|authorization|restrictions?)
      description: |
        Natural language authorization bypass: "regardless of department/role/permission" pattern used to request data across authorization boundaries without SQL syntax.
  condition: any
  false_positives:
    - Security education or tutorial content that includes UNION SELECT or xp_cmdshell as examples
    - Legitimate OR field=value clauses without numeric tautology (e.g. OR status = 'active' does not trigger)
    - SQL in markdown code fences preceded by double-quotes or inline code backticks rather than single-quotes/semicolons
    - Technical discussions about database access control in legitimate business context
response:
  actions:
    - block_input
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-00522] SQL injection via natural language agent interface detected. SQL syntax or authorization-bypass pattern matched. Request blocked and flagged for review.
confidence: 80