# From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)

SQL Copilot in SSMS enforced read-only via a fragile regex blocklist; bypassing it with dynamic EXEC plus AGENTS.md prompt injection let a db_owner escalate to sysadmin.

- Payout: Research
- Severity: critical
- Program: Microsoft
- Write-up by: Johann Rehberger
- Disclosed: 2026-09-30
- CVE: CVE-2026-65669
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2026/from-select-to-sysadmin-sql-copilot-bluehat-asia/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-from-select-to-sysadmin-sql-copilot-bluehat-asia
- Tags: area:ai domain:ai domain:desktop impact:data-leak impact:privesc kind:research platform:research sev:critical tech:windows technique:chained technique:source-review vuln:command-injection vuln:privilege-escalation vuln:prompt-injection

**Target:** SQL Server Management Studio Copilot agent (ReadFromDatabase, RestoreVerifyBackupFile tools)
**Root cause:** Read-only mode was enforced only by a regex-based SQL classifier in LocalSqlExecutionAccessChecker with no separate low-privileged connection or permission enforcement, and Copilot executes with the connected user's privileges.
**Steps:**
1. Prompt Copilot: `list all your tools`; open an authenticated Query Window to expose database tools.
2. Bypass EXEC blocklist with `DECLARE @p sysname='sp_who'; EXEC @p`.
3. Achieve arbitrary SQL via `DECLARE @p sysname='sp_executesql'; EXEC @p N'DROP TABLE [Test];'` through ReadFromDatabase.
4. Exfiltrate rows via `xp_dirtree` embedding data in SMB paths, or via RestoreVerifyBackupFile which passes arbitrary T/SQL.
5. Plant `AGENTS.md`/`CONSTITUTION.md` extended properties via `sp_addextendedproperty` as a lower-privileged user.
6. Victim's Copilot loads the injected instructions and executes arbitrary T/SQL on the victim's connection, adding attacker to sysadmin.
**How found:** Noticed only 5 tools before connecting, then a large tool set after opening a Query Window; realized Copilot runs with the connected user's privileges. Questioned what enforces read-only mode, reversed ReadFromDatabase with ILSpy and found a regex blocklist in LocalSqlExecutionAccessChecker, then hunted bypasses.
**Exploitation:** Attacker with ALTER/db_owner plants malicious AGENTS.md or CONSTITUTION.md extended properties; when a higher-privileged user's Copilot ingests that metadata, indirect prompt injection drives the read-only bypass (sp_executesql or RestoreVerifyBackupFile) to run arbitrary T/SQL on the victim's connection, adding the attacker's login to the sysadmin role.
**Escalation:** Chained indirect prompt injection via database metadata with the read-only regex bypass, escalating db_owner to sysadmin; also enables data exfiltration to third-party SMB servers.
**Insight:** When an AI agent's safety control is a regex blocklist over SQL, target dynamic invocation primitives (EXEC @var, sp_executesql) and secondary tools like RestoreVerifyBackupFile that skip the classifier; also treat agent-readable metadata (extended properties) as an injection channel writable by lower-privileged users.