--- title: Oops, I Weaponized the Database: Abusing AI Features in... description: SQL Server 2025 introduces three AI-focused features — sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL, and AI_GENERATE_EMBEDDINGS — that can be abused... canonical: https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 | daily.dev og:description: SQL Server 2025 introduces three AI-focused features — sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL, and AI_GENERATE_EMBEDDINGS — that can be abused... og:url: https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg og:image: https://api.daily.dev/og/posts/nrnsQoAPg.png og:image:alt: Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 **[SpecterOps](https://daily.dev/sources/specterops)** · 19 min read · 0 upvotes · 0 comments ## Summary SQL Server 2025 introduces three AI-focused features — sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL, and AI_GENERATE_EMBEDDINGS — that can be abused for offensive security purposes. The post demonstrates proof-of-concept attacks including database and file exfiltration via 100MB HTTPS payloads, persistent trigger-based exfiltration, NTLM SMB coercion via UNC paths in EXTERNAL MODEL definitions, and a full C2 agent built in T-SQL and .NET CLR that disguises traffic as AI embedding data. Defensive recommendations include restricting sysadmin privileges, auditing xp_cmdshell and CLR assembly usage, alerting on EXTERNAL MODEL changes, blocking unknown egress from SQL Server, and baselining legitimate embedding traffic patterns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is sp_invoke_external_rest_endpoint in SQL Server 2025 and what are its limits? sp_invoke_external_rest_endpoint is a new stored procedure in SQL Server 2025 that allows the database engine to make native HTTPS requests to arbitrary REST endpoints. It requires the feature to be enabled, HTTPS connections, and a verifiable certificate chain on the remote server. Payloads can be up to 100 MB in size, making it viable for large-scale data transfer directly from the database engine. _Teams evaluating SQL Server 2025 for production track new attack surface like this on daily.dev._ ### Can SQL Server 2025 CREATE EXTERNAL MODEL be used with UNC paths to coerce NTLM authentication? Yes. When defining an ONNX Runtime external model in SQL Server 2025, both the LOCATION and LOCAL_RUNTIME_PATH parameters accept UNC paths. Specifying an attacker-controlled UNC path and then calling AI_GENERATE_EMBEDDINGS triggers NTLM SMB authentication from the SQL Server service account. Microsoft reviewed this behavior and determined it does not violate a security boundary, so no patch is planned. _Red teamers and defenders tracking MSSQL lateral movement techniques follow developments like this on daily.dev._ ### How can SQL Server 2025 AI features be used to build a C2 channel? SQL Server 2025's AI_GENERATE_EMBEDDINGS function can serve as a C2 transport by registering an attacker-controlled HTTPS server as an EXTERNAL MODEL. A T-SQL WHILE loop polls the server for commands via AI_GENERATE_EMBEDDINGS check-ins and returns output the same way. A more advanced version loads a .NET CLR assembly in-memory that XOR-encrypts traffic and encodes it to resemble legitimate embedding vector data, replacing xp_cmdshell with direct CreateProcessW calls via P/Invoke. _Defenders baselining SQL Server egress behavior against threats like this stay current on daily.dev._ ## Similar posts on daily.dev - [The Attack Surface of Cloud-Based Generative AI Applications is Evolving](https://daily.dev/posts/the-attack-surface-of-cloud-based-generative-ai-applications-is-evolving-tzdyoksk3) · Security Boulevard · 2 upvotes · 0 comments - [Windows Native AI Suite Vulnerable to Living-off-the-Land Attacks](https://daily.dev/posts/windows-native-ai-suite-vulnerable-to-living-off-the-land-attacks-8vho4ixfn) · AI Cyber Insights · 0 upvotes · 0 comments - [Every Old Vulnerability Is Now an AI Vulnerability](https://daily.dev/posts/every-old-vulnerability-is-now-an-ai-vulnerability-lu06ouzxc) · Dark Reading · 1 upvotes · 0 comments - [How We Hacked McKinsey's AI Platform](https://daily.dev/posts/how-we-hacked-mckinsey-s-ai-platform-0ytld3sed) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft-sql-server](https://daily.dev/tags/microsoft-sql-server), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025","url":"https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg"},"datePublished":"2026-08-23T12:16:31.247Z","dateModified":"2026-08-23T12:18:22.540Z","description":"SQL Server 2025 introduces three AI-focused features — sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL, and AI_GENERATE_EMBEDDINGS — that can be abused...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d1d68f883e85f0be84a9e0acb79176b5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d1d68f883e85f0be84a9e0acb79176b5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft-sql-server,data-exfiltration","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/oops-i-weaponized-the-database-abusing-ai-features-in-sql-server-2025-nrnsqoapg#faq","mainEntity":[{"@type":"Question","name":"What is sp_invoke_external_rest_endpoint in SQL Server 2025 and what are its limits?","acceptedAnswer":{"@type":"Answer","text":"sp_invoke_external_rest_endpoint is a new stored procedure in SQL Server 2025 that allows the database engine to make native HTTPS requests to arbitrary REST endpoints. It requires the feature to be enabled, HTTPS connections, and a verifiable certificate chain on the remote server. Payloads can be up to 100 MB in size, making it viable for large-scale data transfer directly from the database engine. Teams evaluating SQL Server 2025 for production track new attack surface like this on daily.dev."}},{"@type":"Question","name":"Can SQL Server 2025 CREATE EXTERNAL MODEL be used with UNC paths to coerce NTLM authentication?","acceptedAnswer":{"@type":"Answer","text":"Yes. When defining an ONNX Runtime external model in SQL Server 2025, both the LOCATION and LOCAL_RUNTIME_PATH parameters accept UNC paths. Specifying an attacker-controlled UNC path and then calling AI_GENERATE_EMBEDDINGS triggers NTLM SMB authentication from the SQL Server service account. Microsoft reviewed this behavior and determined it does not violate a security boundary, so no patch is planned. Red teamers and defenders tracking MSSQL lateral movement techniques follow developments like this on daily.dev."}},{"@type":"Question","name":"How can SQL Server 2025 AI features be used to build a C2 channel?","acceptedAnswer":{"@type":"Answer","text":"SQL Server 2025's AI_GENERATE_EMBEDDINGS function can serve as a C2 transport by registering an attacker-controlled HTTPS server as an EXTERNAL MODEL. A T-SQL WHILE loop polls the server for commands via AI_GENERATE_EMBEDDINGS check-ins and returns output the same way. A more advanced version loads a .NET CLR assembly in-memory that XOR-encrypts traffic and encodes it to resemble legitimate embedding vector data, replacing xp_cmdshell with direct CreateProcessW calls via P/Invoke. Defenders baselining SQL Server egress behavior against threats like this stay current on daily.dev."}}]} ```