In the rush to integrate generative AI into enterprise workflows, a recurring anti-pattern has emerged: the ‘Text-to-SQL’ bridge. Developers often attempt to map natural language queries directly to SQL execution engines, assuming that LLM-generated strings are safe to run against production MySQL instances. This approach, while conceptually simple, introduces catastrophic risks that bypass traditional application-layer security.

Our recent audit of a system integrating Microsoft Copilot with a legacy MySQL backend revealed that even with strict schema pruning, the model’s ability to ‘hallucinate’ intent leads to dangerous query execution patterns. By treating the LLM as a [database](/blog/introducing-dbctx-compile-postgresql-database-into-llm-friendly-context) client, you effectively grant a black-box entity the ability to traverse your relational graph, often in ways that are impossible to audit or constrain via standard application logic.

The Illusion of Contextual Safety

When an LLM generates a SQL query, it relies on the provided schema and prompt context. However, modern LLMs are trained on vast datasets containing malformed SQL, anti-patterns, and implicit assumptions about database state. When a user asks a question, the model might infer an intent that correlates with a ‘SELECT’ statement but inadvertently includes ‘DROP’ or ‘UPDATE’ syntax if the model’s safety guardrails are bypassed by clever prompt injection.

Even with read-only database users, the risk remains high. A model can generate resource-intensive queries—such as cross-joins on multi-million row tables—that effectively perform a self-inflicted Denial of Service (DoS) attack. Without an intermediate translation layer, the database engine has no way to distinguish between a legitimate analytical query and an LLM-generated nightmare.

The Failure of Schema Pruning

Common mitigation strategies involve stripping the schema down to only necessary columns. While this reduces the attack surface, it creates a false sense of security. The underlying problem is that the database remains the ‘source of truth’ for the LLM’s reasoning, rather than the application layer. If your schema is complex, the LLM will inevitably struggle with foreign key relationships, leading to inaccurate results that can be misinterpreted by business users.

The Cost of Direct Translation

Direct translation layers are notoriously difficult to test. You cannot unit test the entire surface area of an LLM’s SQL generation capability. Instead, you are left with a system that works 95% of the time, failing catastrophically on the remaining 5%—a failure rate that is unacceptable for production data systems.

The Secure Pattern: The API Facade

The only robust solution is to decouple the LLM from the database entirely. Instead of allowing the LLM to write SQL, the application should expose a set of well-defined, parameterized APIs or ‘Tools’. In this model, the LLM determines which function to call, and the application layer executes the query using sanitized, type-safe parameters.

// AVOID: Direct LLM SQL Generation
// const sql = await llm.generateQuery(userPrompt);
// db.execute(sql);

// RECOMMENDED: Tool-based interaction
const tools = {
  getUserUsage: async (userId: string) => {
    return db.select().from(usage).where(eq(usage.userId, userId));
  }
};

// The LLM only selects the tool and provides the parameter

By using this pattern, you enforce business logic at the application layer. The database only sees requests that the developer has explicitly allowed. If the LLM tries to access data it shouldn’t, it is limited by the scope of the function parameters, not the entire database schema.

Conclusion

Directly connecting LLMs to databases is a violation of the principle of least privilege. As we move toward more autonomous AI agents, the necessity of an intermediate ‘agentic’ layer becomes clear. Treat the LLM as a user of your application, not as a database administrator. By enforcing strict API boundaries, you protect the integrity of your data while still leveraging the power of natural language interfaces.