Topic starter
06/11/2026 6:36 pm
TL;DR: SQL Server 2025 AI features can be abused to turn a database engine into an exfiltration channel and command-and-control transport, according to SpecterOps, using new REST, external model, and embedding capabilities to move data and callbacks over trusted HTTPS. The security problem is not AI itself but the normalisation of outbound trust from systems defenders have long treated as internal-only.
Editorial analysis by NHI Mgmt Group, based on content published by SpecterOps: “Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025”.
Key questions
Q: How should teams govern AI features in database engines?
A: Teams should govern database AI features as externally reachable code paths, with explicit approval, least-privilege execution, outbound allow-lists, secret isolation, logging, and a clear owner for every feature.
Q: Why can a database engine become an exfiltration channel?
A: A database engine can become an exfiltration channel when it is allowed to make trusted outbound connections that carry query results, prompts, or metadata to an external destination.
Q: How do AI features change SQL Server attack surface?
A: AI features change SQL Server attack surface by adding new outbound request paths, new parsing and serialisation logic, and new permission checks around data sent to external services.
Practitioner guidance
- Inventory every SQL Server 2025 AI-capable instance Identify where external REST endpoints, external models, and embedding functions are enabled, then classify each instance by business need and exposure.
- Restrict outbound destinations for database engines Allow only approved model hosts and API endpoints from SQL Server subnets, and block general internet egress wherever the feature set does not require it.
- Review privileged database identities and service accounts Remove standing sysadmin rights where possible, and treat the SQL Server service account as a governed non-human identity with explicit ownership and rotation.
Bottom line: SQL Server AI features can turn a trusted database engine into a covert transport for exfiltration and callback traffic.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Database AI features are becoming an identity and egress governance problem, not just an application feature set. Once SQL Server can call external endpoints and external model services, the security question shifts from whether the feature works to who can activate it, where it can send data, and how that traffic is monitored. That places database service accounts, administrative roles, and outbound policy in the same control plane. Practitioners should treat database AI enablement as a governed identity decision, not a simple platform toggle.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do AI features change SQL Server attack surface?
A: AI features change SQL Server attack surface by adding new outbound request paths, new parsing and serialisation logic, and new permission checks around data sent to external services. That creates extra routes for data exposure, command misuse, and privilege abuse beyond normal query execution, so the feature must be treated as an internet-reachable integration point.
👉 Read our full editorial: SQL Server 2025 AI features expand database exfiltration and C2 risk