databricks-dbsql

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Databricks AI functions like ai_query(..., request) ingest the SQL-provided request text at runtime (e.g., concatenated from table columns such as feedback/description), so an outsider who can submit/poison those table values can indirectly supply free text to the LLM without any need for the agent to “select a specific item” from a trusted source.