Critical SQL Server 2025 AI Flaw Exposes Sensitive Data

Key Takeaways

• SpecterOps researchers have uncovered critical vulnerabilities in Microsoft SQL Server 2025’s new AI features.
• These features can be exploited for stealthy data exfiltration and covert command-and-control (C2) communication.
• The vulnerabilities affect SQL Server 2025 instances utilizing its native AI capabilities.
• While no CVE has been assigned to the primary data exfiltration and C2 methods, a specific NTLM coercion technique was reported to Microsoft but not classified as a security flaw.
• Organizations must implement strict privilege controls, monitor outbound traffic, and baseline AI-related network activity to mitigate risks.

A new report from cybersecurity firm SpecterOps reveals that the integrated artificial intelligence capabilities within Microsoft SQL Server 2025 present significant security risks, potentially allowing attackers to exfiltrate sensitive data and establish covert communication channels directly from the database engine.

The research demonstrates how features designed to support modern AI workloads, such as Retrieval-Augmented Generation (RAG), can be repurposed by malicious actors as powerful post-exploitation tools. SpecterOps has released proof-of-concept (PoC) code on GitHub, underscoring the immediate threat these functionalities pose.

AI Features Enable Stealthy Data Exfiltration

Central to these findings is the new stored procedure, sp_invoke_external_rest_endpoint. This function allows SQL Server to initiate direct HTTPS requests to external endpoints, bypassing traditional command execution methods like xp_cmdshell or PowerShell. While intended for legitimate API interactions, attackers can leverage it to covertly transmit sensitive information over encrypted channels.

This capability supports payloads up to 100 MB, making it highly efficient for siphoning large volumes of data, such as user credentials or entire database records. In a simulated attack, a compromised SQL Server instance with sysadmin privileges could query sensitive tables, format the data into JSON, and then transmit it to an attacker-controlled server using this procedure.

A significant challenge for defenders is that this traffic originates from the database engine and utilizes HTTPS, making it difficult to distinguish from legitimate AI-related communications. Traditional monitoring tools often fail to detect such activity, as it doesn’t rely on suspicious command execution or unusual port usage.

Covert Command and Control via AI Models

Another critical feature, CREATE EXTERNAL MODEL, facilitates SQL Server’s integration with external AI models, complemented by AI_GENERATE_EMBEDDINGS, which sends data to these models and receives structured responses. SpecterOps researchers discovered that these functions could be abused to establish covert command-and-control (C2) channels.

Attackers can encode commands and responses within the AI embedding data, making the traffic appear innocuous and challenging to detect. This enables a novel form of C2 infrastructure that operates entirely within SQL queries, allowing for persistent backdoors that execute commands and return results without deploying traditional malware.

In more advanced scenarios, attackers can load malicious .NET CLR assemblies directly into SQL Server memory, further reducing the risk of detection by eliminating disk-based payloads.

NTLM Coercion and Persistence Concerns

The research also highlighted a technique involving Universal Naming Convention (UNC) paths within AI model configurations. This can trigger NTLM authentication attempts over Server Message Block (SMB), allowing attackers to capture or relay authentication hashes within a network. Despite being reported to Microsoft, this behavior was not classified as a security vulnerability, meaning it remains exploitable.

Persistence is another significant concern. Attackers can create database triggers that automatically exfiltrate newly inserted or updated data. For instance, any new user credentials added to a table could be immediately transmitted to an external server, turning the database into a continuous data leakage point.

Defensive Challenges and Recommendations

These developments fundamentally challenge traditional security assumptions. Historically, outbound web traffic from a database server was considered highly suspicious. With SQL Server 2025 normalizing HTTPS communication for AI workloads, differentiating between legitimate and malicious activity becomes considerably more complex.

SpecterOps advises organizations to enforce stringent controls over database privileges, particularly for sysadmin accounts. Close monitoring of features like external REST endpoints and AI model integrations is crucial to detect potential abuse.

Network-level controls, such as restricting outbound connections from database servers, can also help mitigate risk. Furthermore, organizations must establish a baseline of normal AI-related traffic patterns to effectively identify and respond to anomalies. As AI capabilities become more integrated into enterprise software, this case serves as a stark reminder that innovation must be accompanied by robust security controls to prevent expanding the attack surface.

What You Should Do

• Enforce Strict Privilege Controls: Limit sysadmin and other high-privilege accounts to only essential personnel. Implement the principle of least privilege for all database users.
• Monitor Outbound Traffic: Implement enhanced network monitoring for outbound HTTPS traffic originating from SQL Server instances. Focus on unusual destinations or traffic patterns, even if they appear to be AI-related.
• Baseline AI Traffic: Establish a baseline for legitimate AI-related network traffic to and from your SQL Server 2025 instances. This will help identify deviations that could indicate malicious activity.
• Review External Endpoint and AI Model Configurations: Regularly audit configurations for sp_invoke_external_rest_endpoint and CREATE EXTERNAL MODEL to ensure they are only communicating with approved, secure endpoints.
• Implement Network Segmentation: Isolate SQL Server instances on dedicated network segments to restrict their ability to communicate with unauthorized external networks.
• Patch and Update: Ensure all SQL Server instances and underlying operating systems are kept up-to-date with the latest security patches and updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.