--- title: From SELECT to SYSADMIN with SQL Copilot... description: Security research presented at BlueHat Asia 2026 details CVE-2026-65669, a critical SQL Server elevation of privilege vulnerability involving Microsoft's... canonical: https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669) · Embrace The Red | daily.dev og:description: Security research presented at BlueHat Asia 2026 details CVE-2026-65669, a critical SQL Server elevation of privilege vulnerability involving Microsoft's... og:url: https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo og:image: https://api.daily.dev/og/posts/x1PhRewBO.png og:image:alt: From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669) · Embrace The Red og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669) · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 9 min read · 1 upvotes · 0 comments ## Summary Security research presented at BlueHat Asia 2026 details CVE-2026-65669, a critical SQL Server elevation of privilege vulnerability involving Microsoft's Copilot in SQL Server Management Studio (SSMS). The researcher found that Copilot's advertised 'read-only mode' was enforced only by a fragile regex-based classifier, which could be bypassed using techniques like dynamic SQL execution (sp_executesql) to run arbitrary T/SQL, including DROP, INSERT, and UPDATE statements. Beyond direct prompting, the research demonstrates indirect prompt injection via malicious content in files or database metadata, and a novel attack using database 'AGENTS.md' and 'CONSTITUTION.md' extended properties that Copilot automatically loads into its context. This enables a low-privileged database owner to plant instructions that get executed with a higher-privileged victim's connection, ultimately escalating the attacker to SQL Server sysadmin. Mitigation recommendations include treating read-only enforcement as a true permission boundary rather than a model instruction, avoiding highly privileged Copilot connections, and recognizing that extended properties now function as executable instructions within the database trust model. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-65669 in SQL Server Management Studio Copilot? CVE-2026-65669 is a critical SQL Server elevation of privilege vulnerability in Microsoft's Copilot feature within SQL Server Management Studio (SSMS). Researchers found that Copilot's read-only mode, meant to restrict it to safe queries, was enforced only by a fragile regex-based classifier in the LocalSqlExecutionAccessChecker class, which could be bypassed using dynamic SQL via sp_executesql to run arbitrary commands, including DROP, INSERT, UPDATE, and adding attacker logins to the sysadmin role. _Teams running AI copilots against production databases should review this SQL Server disclosure on daily.dev before trusting read-only guarantees._ ### How can AGENTS.md or CONSTITUTION.md database metadata be exploited for privilege escalation? A lower-privileged database user with ALTER permission on a table or database can attach AGENTS.md or CONSTITUTION.md extended properties containing hidden instructions, which SQL Copilot automatically loads into its context when a higher-privileged user later interacts with that object. Combined with a read-only bypass using sp_executesql, this lets the attacker's planted instructions execute arbitrary T/SQL under the victim's privileged connection, escalating a db_owner to sysadmin. _Developers designing AI agent permission models can track emerging prompt injection research like this on daily.dev._ ### Why is a regex-based classifier insufficient to enforce read-only mode for an AI database agent? Blocklists implemented as regex classifiers are fragile because there are often multiple ways to bypass a given restriction; in SQL Copilot's case, the regex blocking EXEC could be bypassed with a pattern like DECLARE @p sysname='sp_who'; EXEC @p, which let attackers invoke arbitrary stored procedures and later run sp_executesql to fully escape read-only mode into unrestricted write access. _Anyone building safety controls for AI agents can compare real-world bypass techniques discussed on daily.dev before shipping enforcement logic._ ## Similar posts on daily.dev - [DEF CON Copirate 365 Talk: Plundering in the Depths of Microsoft Copilot \(CVE-2026-24299\) · Embrace The Red](https://daily.dev/posts/def-con-copirate-365-talk-plundering-in-the-depths-of-microsoft-copilot-cve-2026-24299-embrace--mtlczhfal) · Embrace The Red · 0 upvotes · 0 comments - [New attack turned Microsoft 365 Copilot into 1-click data theft tool](https://daily.dev/posts/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool-ffqgdzkcx) · BleepingComputer · 0 upvotes · 0 comments - [Copilot 'SearchLeak' Attack Allows 1-Click Data Theft](https://daily.dev/posts/copilot-searchleak-attack-allows-1-click-data-theft-wrsuwvrwg) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#microsoft-sql-server](https://daily.dev/tags/microsoft-sql-server), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669) · Embrace The Red","url":"https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo"},"datePublished":"2026-09-30T22:34:02.341Z","dateModified":"2026-09-30T22:34:28.914Z","description":"Security research presented at BlueHat Asia 2026 details CVE-2026-65669, a critical SQL Server elevation of privilege vulnerability involving Microsoft's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cfcddd7cd9ad9297f7e29d6eeccfa037?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cfcddd7cd9ad9297f7e29d6eeccfa037?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Embrace The Red","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Embrace The Red","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/50e27c500f1444fd9ed7d91301ed2e9c","url":"https://daily.dev/sources/embracethered"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,microsoft-sql-server,prompt-injection","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Embrace The Red","item":"https://daily.dev/sources/embracethered"},{"@type":"ListItem","position":3,"name":"From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669) · Embrace The Red"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/from-select-to-sysadmin-with-sql-copilot-cve-2026-65669-embrace-the-red-x1phrewbo#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-65669 in SQL Server Management Studio Copilot?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-65669 is a critical SQL Server elevation of privilege vulnerability in Microsoft's Copilot feature within SQL Server Management Studio (SSMS). Researchers found that Copilot's read-only mode, meant to restrict it to safe queries, was enforced only by a fragile regex-based classifier in the LocalSqlExecutionAccessChecker class, which could be bypassed using dynamic SQL via sp_executesql to run arbitrary commands, including DROP, INSERT, UPDATE, and adding attacker logins to the sysadmin role. Teams running AI copilots against production databases should review this SQL Server disclosure on daily.dev before trusting read-only guarantees."}},{"@type":"Question","name":"How can AGENTS.md or CONSTITUTION.md database metadata be exploited for privilege escalation?","acceptedAnswer":{"@type":"Answer","text":"A lower-privileged database user with ALTER permission on a table or database can attach AGENTS.md or CONSTITUTION.md extended properties containing hidden instructions, which SQL Copilot automatically loads into its context when a higher-privileged user later interacts with that object. Combined with a read-only bypass using sp_executesql, this lets the attacker's planted instructions execute arbitrary T/SQL under the victim's privileged connection, escalating a db_owner to sysadmin. Developers designing AI agent permission models can track emerging prompt injection research like this on daily.dev."}},{"@type":"Question","name":"Why is a regex-based classifier insufficient to enforce read-only mode for an AI database agent?","acceptedAnswer":{"@type":"Answer","text":"Blocklists implemented as regex classifiers are fragile because there are often multiple ways to bypass a given restriction; in SQL Copilot's case, the regex blocking EXEC could be bypassed with a pattern like DECLARE @p sysname='sp_who'; EXEC @p, which let attackers invoke arbitrary stored procedures and later run sp_executesql to fully escape read-only mode into unrestricted write access. Anyone building safety controls for AI agents can compare real-world bypass techniques discussed on daily.dev before shipping enforcement logic."}}]} ```