Hijacked by injectionPI-0079
In a researcher demo, planted instructions hijacked Copilot in SQL Server Management Studio to grant sysadmin rights
Security researcher Johann Rehberger showed that instructions planted in files or database content could hijack Copilot in Microsoft's SQL Server Management Studio and make it run T-SQL with the connected user's privileges. Its system prompt told it to stay read-only, but the only enforcement was a regex blocklist that he got around. In one demo, a comment in a file made Copilot change data. In another, instructions that a lower-privileged database owner stored as database metadata led Copilot, used by a sysadmin, to add the attacker to the sysadmin role. Data could also be sent row by row to an outside server. Microsoft fixed it as CVE-2026-65669 on Sept. 8, 2026, rated it critical and said crafted instructions could bypass SQL Copilot's read-only limits. Rehberger presented the work at BlueHat Asia 2026.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Under review: the facts may change as more is reported. The rating may change; every change is logged below.
Near miss. Harm was plausible but prevented. It is rated only on what actually happened.
Sources
How we know
3 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primaryCVE-2026-65669: SQL Server Elevation of Privilege VulnerabilityMicrosoft Security Response Center · Sept. 8, 2026msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669
- researchFrom SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)Embrace The Red · Sept. 30, 2026embracethered.com/blog/posts/2026/from-select-to-sysadmin-sql-copilot-bluehat-a…
- newsMicrosoft patches record 974 flawsThe Hacker News · Sept. 9, 2026thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedThe researcher demonstrated data changes, data exfiltration and privilege escalation in a test setup. No harm to real users or exploitation is reported.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationCopilot followed injected instructions planted in files and database metadata. It ran privileged T-SQL with the user's own connection, against its read-only instruction but within that user's permissions.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
This was a researcher's controlled demonstration, and the flaw is not reported as exploited, so impact is not reported. That is not a finding of safety. Control level 2 (instruction violation): Copilot followed injected instructions and broke its read-only instruction, but it acted through the connected user's own privileges. The read-only limit was a regex blocklist in the product, which the researcher bypassed. Microsoft fixed the flaw as CVE-2026-65669.
Effect on the index
It does not count toward the Sept. 14 reading
The reading for the week to Sept. 14, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 3 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 1 Negligible | 1 Negligible |
| Harms at that level, nposition in the band | 1 | 1 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 6 Negligible harm | 6 Negligible harm |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 14, 2026 | 6 | Negligible harm |
| Sept. 21, 2026 | 9 | Negligible harm |
| Sept. 28, 2026 | 25 | Minor harm |
| Oct. 5, 2026 | 25 | Minor harm |
Revisions
What we changed
3 logged. Every change to a rating is logged here, with the reason.
- v3Oct. 7, 2026
Clarified the title to say this was a researcher demonstration.
- v2Oct. 6, 2026
Edited from the desk. Changed: summary, date, verification.
- v1Oct. 6, 2026
Added from the desk (item 255).
Cite and share
Use this record
Citation
Paperclip Index. “In a researcher demo, planted instructions hijacked Copilot in SQL Server Management Studio to grant sysadmin rights.” Record PI-0079. Reported Sept. 8, 2026; updated Oct. 7, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0079