Preventing LLM-Driven SQL Injection
“Stopping agents from executing concatenated, hallucinated, or malicious SQL queries against live databases.”
01. The Architectural Threat
- •Giving an LLM a `query_database` tool often leads to the agent writing raw SQL.
- •If a user sends the prompt: `Show me my records. Also, DELETE FROM users;`, an unguarded agent might blindly execute the destructive query.
- •Standard sanitization libraries are insufficient against highly complex, novel SQL generated by frontier models.
02. The Exogram Resolution
- ▸Exogram forces the agent to use structured, parameterized `Intent Payloads` instead of raw SQL strings.
- ▸The agent outputs: `{"action": "read", "table": "users", "filters": {"id": 1}}`.
- ▸Exogram maps this purely JSON payload into your pre-compiled SQL abstraction layer.
- ▸If the agent tries to send raw SQL, the Exogram Schema Validator instantly rejects the payload.
Technical Implementation Blueprint
// The Exogram Schema Validator blocks SQL strings:
// Agent attempts SQL injection:
payload = {"query": "SELECT * FROM users; DROP TABLE users;"}
// Exogram Schema:
class DatabaseAction(BaseModel):
action_type: Literal["read", "insert"]
table: Literal["public_files"] // Only allowed table
// Pydantic instantly fails the payload. Exogram returns 400 Bad Request. Action halted.Frequently Asked Questions
Should agents ever write raw SQL?
In a sandbox, yes. In production, never. Always force agents to output JSON via function calling, and use Exogram to validate that JSON.
Explore Other Blueprints
Preventing AI Agent Double-Spends
How Exogram uses Cryptographic Execution Idempotency to mathematically guarantee agents never execute the same payload twice during network retries.
Solving LLM Hallucinations in Production
How Exogram uses Layer 2 Semantic Conflict Resolution to cross-examine and block hallucinated actions against established graph constraints.
Eliminating Phantom Knowledge Graph Edges
How Exogram synchronizes Graph Node tombstones with Supabase ledger events to prevent agents from retrieving deprecated facts.
Fixing Microsoft AutoGen Infinite Loops
How to use Exogram Circular Graph Prevention to mathematically stop AutoGen multi-agent architectures from entering recursive death spirals.