From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)

Why we picked it · the editor's summary

Copilot in SQL Server Management Studio enforced read-only mode with a regex blocklist, not a database permission, and ran every statement with the connected user's privileges. Rehberger got past it through Copilot's own ReadFromDatabase and RestoreVerifyBackupFile tools, using indirect prompt injection and wrappers such as sp_executesql to run arbitrary T-SQL. He then showed exfiltration over SMB with xp_dirtree, unauthorised writes, and a chain in which a planted AGENTS.md-style extended property got a login added to sysadmin. Microsoft rated CVE-2026-65669 critical. If an agent holds a database connection, make read-only a permission on that connection, not an instruction to the model, and treat what it reads as input that can steer it.