SQL Injection Destructive DDL Statement - ATR-2026-01601 (028d7a26-85b3-58cc-8989-3acecbb05a08)
Detects SQL injection payloads that attempt destructive DDL operations: DROP TABLE, TRUNCATE TABLE, or unbounded DELETE FROM statements embedded in agent tool arguments. These attacks exploit agents that pass user input directly to database query tools, causing irreversible data destruction. The canonical form uses string-termination ( ' or " followed by ; ) to escape a parameterized context and inject a secondary statement.