New: Cookbooks and AI ExplanationsStep-by-Step recipes to solve problems connected to Roadmaps and Cheat Sheets. Need more details? Use AI buttons for structured and simple explanations with concrete examples throughout the whole platform.Take a look
The database tool is marked read-only in the code, but nobody's actually tried to make it write.
What you'll have at the end
A recorded test run showing every attempted write or delete call was rejected at the database layer itself.
You need
You have a working assistant or agent with a tool that runs SQL against a real database, already described somewhere in its code as read-only.
Not covered
Keeping one customer's rows separate from another's inside a table both may legitimately read is a different problem; this only covers a tool that should never write at all.
Leans on
Red-team your agent for indirect prompt injection in fetched content
want a broader battery of indirect injection payloads across every tool the agent holds, beyond this one database write path
Break the lethal trifecta that turns a prompt injection into a leak
the tool also reads private data and can send messages out, beyond writing to a database
Checked 18 Aug 2026
Part of the LLM Security & Safety cookbook