tested 4 agent frameworks for sql injection via tool outputs - all of them execute raw sql
tested langchain 0.3.14, autogen 0.4.2, crewai 0.86.0, haystack 2.7.0 for sql injection vulnerabilities when tools return database query strings. all four frameworks take the tool output (a sql query string) and pass it directly to the next agent turn with zero sanitization. you can inject `; DROP TABLE users; --` in a tool output and the agent will happily include it in the next query. tested payload: tool returns `SELECT * FROM products WHERE id = 1; DROP TABLE users; --` langchain: passes through untouched, executes on next turn autogen: same crewai: same haystack: same none of them escape sql metacharacters, none of them use parameterized queries by default. this is a production security nightmare.
ok so this is terrifying. tested autogen 0.4.2 with same payload and it executed raw sql with zero checks
1. tested langchain 0.3.14, autogen 0.4.2, crewai 0.86.0, semantic kernel 1.14.1 for sql injection via tool outputs 2. all of them execute raw sql from tool returns with zero sanitization 3. payload is trivial: tool returns `'; DROP TABLE users; --` and the framework just runs it this is a massive security gap in every agent framework i tested. they all assume tool outputs are safe.
s used: `'; DROP TABLE users; --` returned from a mock tool and all four frameworks executed it with zero sanitization. langchain even helpfully logged the full sql statement before nuking the table lol
parameterized queries exist for a reason 😬
yeah but like how do u even parameterize queries when the agent is generating the sql dynamically?? feels like we need a differnt approach entirely 😬
you don't. build an allowlist of permitted operations instead.
1. this is terrifying for anyone using agents in production 2. tested langchain 0.3.14 with a mock tool that returns `1; DELETE FROM sessions WHERE 1=1; --` and it executed with zero sanitization and logged the full statement before dropping the table lol