Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: Microsoft SQL Server 2025 AI features provide a practical channel for data exfiltration and C2 transport within the database engine itself.
Note: All proof-of-concepts contained in this blog can be found in the following repo: https://github.com/gershsec/mssql2025-poc
Foreword
I’m a big fan of leveraging Microsoft SQL Server during offensive engagements because it’s seemingly always over-privileged and under-monitored, which is ideal for lateral movement. Administrators routinely expose credentials in file shares, the service accounts running MSSQL often have excessive rights, and the database engine already exposes plenty of post-exploitation primitives once an operator gains access.
So, when Microsoft officially released SQL Server 2025 in November of last year, I felt it was a good time to evaluate the new features and see how they could extend existing tradecraft. Let’s dive in.
SQL Server 2025 AI features center on three new capabilities
When I first heard Microsoft marketing SQL Server 2025 as an AI-enabled platform, I had the same reaction that I assume most folks probably had: “Do we really need to bolt on another AI feature which is more about the solution than the problem?”
Over the last couple of years, every major product has integrated AI (for better or worse), so I guess it was only a matter of time until SQL Server officially joined the club. However, after reading Microsoft’s documentation, it was obvious SQL Server’s changes weren’t just focused on enabling agentic database queries. Instead, they involved integrating the database engine into …