CyberSecurity In Age of AI

Mahad Farooq

Currently any project that you made most likely is storing their data in SQL or query databases (what LLMs default to when they scaffold a backend) is vulnerable to the simplest level of attack. Row-level security. Its barely enforced, RLS policies get written by the same model that wrote the schema, and prompt-injected queries slip through because the LLM trusts its own tool calls.

Even if you have the most complex multi-factored auth layer the model can't rewrite that because its authticated in of itself. Most people shipping AI apps right now don't even know what they don't know, they're one select *away from leaking every user's data and they'll find out from a screenshot on Twitter.

The actual query injection can litterly be as simple as the same type field you are allowing users to type their info from.

Home