What stands out to me is the privilege boundary. If something that looks like a database assistant can end up reaching OS-level privileges, generated SQL really has to be treated as untrusted input. Strong sandboxing and a minimal service account seem more important than trying to make the model itself perfectly safe.

b9609a1d67

Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio.

This post is a write up about the talk, which covered 

, a SQL Server Elevation of Privilege Vulnerability rated critical by Microsoft.

So, make sure your installations are up-to-date.

The slides of the presentation can be found 

devs

> Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio.
>
> This post is a write up about the talk, which covered [CVE-2026-65669](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669), a SQL Server Elevation of Privilege Vulnerability rated critical by Microsoft.
>
> So, make sure your installations are up-to-date.
>
> The slides of the presentation can be found [here](https://embracethered.com/blog/downloads/from-select-to-sysadmin.pdf).
>
> [**...read more at embracethered.com**](https://embracethered.com/blog/posts/2026/from-select-to-sysadmin-sql-copilot-bluehat-asia/)