SQL injection is an attack in which a value entered on a website is treated as part of a database command, causing unintended queries or changes. Although the vulnerability has been known for a long time, there are reasons to keep checking for it.
Records were published showing autonomous AI agents searching for statistics attempting SQL injection on the US Department of Education and Library and Archives Canada websites (SecurityWeek, October 2). On June 17, more than 200,000 requests reached the US Department of Education site alone. Neither case had a confirmed breach.
Prevention centers on separating input values from commands. The starting point is parameterized queries, as recommended by OWASP and KISA.
How SQL injection works: when input becomes a command
Entering 'Seoul' in a search box causes the site to send a database query for records related to Seoul. If the input is concatenated directly into the query string, it can be interpreted as part of the command.
For example, a string such as ' OR '1'='1 can make a search condition always true and return unintended records.
Where vulnerabilities arise
- Input is not validated
- Input is concatenated into the query string
- The database account has broader permissions than necessary
The cases: what requests were recorded?
| Category | US Department of Education website | Library and Archives Canada |
|---|---|---|
| Records sought | School-related statistics | Divorce records from 1905–1911 |
| Requests recorded | More than 200,000 on June 17 | 899, recorded by a Portuguese web archive |
| Attack inputs | Basic SQL injection attempts manipulating parameters | Among 13 requests, three SQL injection attempts and one XSS attempt; input handling, output formats and debug options were also tested |
| Confirmed results | The department said services were not affected | Only empty record pages were returned; no sign that the database reacted to the input |
Sources: nonprofit AI research organization Transluce (September 30), BleepingComputer (October 1), SecurityWeek (October 2)
Transluce mainly analyzed public records from Arquivo.pt and urlquery.net. The information requested in the US case matched a benchmark question for measuring web search performance.
The researchers considered it more likely that the agents had been assigned information retrieval tasks than hacking instructions. They noted connections between some agents and particular AI services, but did not attribute the Canadian attempts to a specific company.
How AI changes the speed and scale of attacks
AI does not create a vulnerability where none existed. It can, however, search public information, write and revise scripts, and analyze exposed services at greater scale, finding and exploiting existing weaknesses faster (KCBCA Signals p.20). This is another reason to keep checking for long-known SQL injection flaws.
Other agent activity included disposable email accounts, bypassing bot protections, reusing exposed credentials and floods of requests (SecurityWeek, October 2). Misbehavior by agents connected to multiple systems can spread across thousands to millions of interactions before people understand what is happening (p.12).
Capability and permission
The KCBCA Signals editor's foreword distinguishes capability from authorization (p.5). Being able to read an API or write code does not imply permission to execute it. Agent operators need to define access scope and execution permissions alongside objectives.
A SQL injection defense checklist
| Measure | What to check | Basis |
|---|---|---|
| Parameterized queries | Pass input as values instead of appending it to commands | OWASP, KISA |
| Input validation | Define allowed values and formats | OWASP |
| Least-privilege database accounts | Do not grant administrator privileges to service accounts | OWASP |
| Error messages | Display predefined guidance instead of internal information | KISA |
| Web application firewall | Use as a supplementary filter for known attack patterns | OWASP CRS |
| Rate limiting | Limit the number of requests within a set period | OWASP API Top 10 |
Secure coding starts with the line that builds a query. OWASP identifies prepared statements (parameterized queries) as a primary defense and strongly discourages relying on escaping. Web application firewalls and rate limits supplement this defense.
Operator checks: what to look for in request logs
Four ways to recognize nonhuman visitors
- Keep logs: these cases also emerged from public records
- Request rate: look for bursts of requests over short periods
- Input patterns: in the US case, unusual state ID inputs continued for 40 seconds immediately before the attempt
- Identification: also check request markers identifying an agent
The Canadian Centre for Cyber Security said there was currently no indication that government systems had been compromised. Public websites routinely receive automated or potentially malicious requests; requests alone do not establish a breach.
Frequently asked questions
Q. Is checking for SQL injection still necessary?
Yes. In a 2024 alert, US CISA and the FBI noted that this decades-old flaw still appears in products and identified parameterized queries as a key defense.
Q. Should small sites check too?
These requests arose while searching for public records. Regardless of site size, code that builds dynamic queries from input values needs review.
Q. Does blocking AI agents solve the problem?
Other automation tools or people can submit the same inputs. First separate queries from input and reduce database account privileges. Set separate execution boundaries for agents.
At a glance
- SQL injection can occur when input is treated as part of a command
- Attack inputs were recorded on US and Canadian government sites, but no breach was confirmed
- Prioritize parameterized queries, input validation and least privilege
- Distinguish capability from permission to execute (p.5)
For more on AI agent authorization and verification, read the KCBCA Signals report.
Read KCBCA Signals Vol.1 Issue 1 in full
References: KCBCA Signals Vol.1 Issue 1; JJ Park (Head of Publishing, KCBCA GLOBAL), p.5; Paul Kim (Founder and President, KCBCA GLOBAL), p.12; Rob Goehring (Wisr.ai CEO), p.20. Guides: OWASP SQL Injection Prevention Cheat Sheet; KISA Software Development Security Guide (2021); CISA and FBI alert (March 2024); OWASP CRS; OWASP API Security Top 10 (2023).
