Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-17 · high
The same parser also missed parenthesized queries and UNION set operations, two more ways a write can slip past the guard as read-only.
Why now: Chaterm merged the fix on Aug. 17, 2026.
Chaterm patched a database guard that let write commands pass as read-only queries, per PR #2484, merged Aug. 17.
That's the only thing stopping a natural-language database agent from writing straight to production data. Miss one hole in that guard and an AI agent meant to only read a table can quietly write to it instead.
Before the fix, the guard missed three cases. Parenthesized queries slipped past unparsed. UNION set operations weren't caught. And the guard accepted a DML statement placed ahead of an EXPLAIN SELECT, per the pull request.
The merged fix also bounds how many times the parser unwraps a query, and it adds handling for VALUES CTEs. That closes two more paths a crafted query can use to dodge classification.
Home-built LLM-to-SQL allowlists carry the same two holes. No allowlist parser gets tested against every wrapping combination on day one. Check whether yours strips parentheses before it classifies a query. Then check what happens when a write statement sits in front of an EXPLAIN.
Each link below shares sources, entities, or timing with this story.
Simon Willison released LLM / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Simon Willison released LLM); both cover EXPLAIN, SQL; overlapping topics (explain, query).
Chaterm supports Codex CLI / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Chaterm supports Codex CLI); both cover GitHub, LLM; reported by the same outlet (github.com).
Simon Willison released LLM / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Simon Willison released LLM); both cover LLM, SQL; earlier LLM coverage from 2026-06-19.
Linked by a graph relationship (Simon Willison released LLM); both cover LLM, SQL; earlier LLM coverage from 2026-06-18.
Simon Willison released LLM / Shared entity: LLM / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; reported by the same outlet (github.com).
LLM uses OpenAI / Shared entity: GitHub / Same source domain / Earlier coverage
Linked by a graph relationship (LLM uses OpenAI); both cover GitHub; reported by the same outlet (github.com).
Simon Willison released LLM / Shared entity: LLM / Same source domain / Earlier coverage
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; reported by the same outlet (github.com).
Simon Willison released LLM / Shared entity: LLM / Shared topic / Earlier coverage
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; overlapping topics (agent, almost).