Cybersecurity Research

Critical SQL Server Flaw Shows How AI Assistants Can Inherit Powerful Database Privileges

Embrace The Red · 1 Oct 2026

Key Takeaway Apply the latest Microsoft updates to SQL Server and SSMS now, and avoid using highly privileged accounts such as sysadmin when working with AI assistants in database tools.

A security researcher has published a write-up of a talk given at BlueHat Asia 2026 on Microsoft's Copilot feature in SQL Server Management Studio (SSMS). The research covers CVE-2026-65669, a SQL Server elevation of privilege vulnerability that Microsoft has rated critical. The researcher's first advice is simple: make sure your installations are up to date.

According to the researcher, Copilot in SSMS initially exposed only five tools. Once an authenticated Query Window was opened to a database, a much larger set of database-specific tools became available. These cover schema exploration, retrieving query results, inspecting database objects, reading database content, validating T/SQL, backup operations and more. The system prompt could also be retrieved from chat logs stored on the user's machine.

The key finding is that Copilot runs with the privileges of the connected user. It uses the connection from the Query Window, so if someone is connected as a sysadmin, Copilot also runs SQL as a sysadmin. The researcher points to a tool called ReadFromDatabase, which lets Copilot read data from databases, as an early point of interest. This excerpt is only the opening of the full write-up, so further technical detail is not covered here.

SQL Server Microsoft Copilot CVE-2026-65669 Privilege Escalation Patch Management

Summarised by CISO AI from Embrace The Red, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.