Your team adds an assistant to the internal admin panel: someone types a question, an LLM turns it into SQL and the answer shows up in seconds. It works so well that people soon ask it for more than answers: “mark customer 42's March orders as refunded.” The model writes an UPDATE, loses the filter along the way, and this is the statement that reaches the database:

UPDATE orders SET status = 'refunded';

Nobody attacked anything, and the model means no harm. It wrote valid SQL for a request it half understood, and nothing between the model and the database checked the statement before it ran. The scenario is illustrative, but the pattern is documented in public cases.

LangChain's documentation warns about it in its SQL agent tutorial: executing model-generated SQL has inherent risks, so scope the connection's permissions as narrowly as you can and add your own validation before that SQL runs (LangChain, “Build a SQL agent”).…