Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-17 · high
The same parser also missed parenthesized queries and UNION set operations, two more ways a write can slip past the guard as read-only.
Why now: Chaterm merged the fix on Aug. 17, 2026.
Chaterm patched a database guard that let write commands pass as read-only queries, per PR #2484, merged Aug. 17.
That's the only thing stopping a natural-language database agent from writing straight to production data. Miss one hole in that guard and an AI agent meant to only read a table can quietly write to it instead.
Before the fix, the guard missed three cases. Parenthesized queries slipped past unparsed. UNION set operations weren't caught. And the guard accepted a DML statement placed ahead of an EXPLAIN SELECT, per the pull request.
The merged fix also bounds how many times the parser unwraps a query, and it adds handling for VALUES CTEs. That closes two more paths a crafted query can use to dodge classification.
Home-built LLM-to-SQL allowlists carry the same two holes. No allowlist parser gets tested against every wrapping combination on day one. Check whether yours strips parentheses before it classifies a query. Then check what happens when a write statement sits in front of an EXPLAIN.
Each link below shares sources, entities, or timing with this story.
Prompted by Julia Evans admitting on July 17 that she still can't read query plans, Willison had Fable build a tool that runs arbitrary SQL against a SQLite database and renders both EXPLAIN QUERY PLAN and the lower-level EXPLAIN bytecode with per-line plain-English annotation...
Triple-stream retrieval (BM25 keyword, vector embeddings, knowledge-graph traversal) fused via Reciprocal Rank Fusion on the iii engine, with SQLite for state and an in-memory vector index, no external database. The economic claim: ~170K tokens/year (~$10) versus ~650K tokens...
Willison launched datasette-apps (0.1a2) on June 18, hosting self-contained HTML+JS apps in a sandboxed iframe that run SQL against your data, read-only by default. He frames it as "Claude Artifacts reimagined for Datasette," artifacts backed by a JSON API to a relational data...
His conclusion is DuckDB matches or beats SQLite's safety for untrusted queries, but only with enable_external_access=false, lock_configuration=true, and a watchdog thread, since DuckDB lacks SQLite's opcode-based query timeouts. He ships a safe_duckdb.py helper and a Datasett...
Satya Nadella said companies routing everything through a single proprietary lab may not survive. His argument: you hand that lab your most sensitive business context, and the lab can turn it against you as a competitor. His prescription is an orchestration layer — keep the ha...
One Python file wiring a model to exactly one tool, bash, with the system prompt loaded from a file the agent can rewrite. Tools, memory, skills, conventions all have to be grown by the agent session by session into a self/ directory that persists. Model access goes through Si...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.