The "SELECT-only" guard that still deleted the data

Description:
A text-to-SQL agent has a safety check: only run queries that start with SELECT. The input was "SELECT 1; DELETE FROM t". How many rows are left?

Zero. startswith() only checks the beginning, and executescript runs every statement in the string, so the DELETE ran.

The fix: reject ';' in the query, and give the agent a read-only database connection. A string check alone is never a safety guard.

This is the kind of failure you learn to catch while you build a text-to-SQL agent in the "Build a Text-to-SQL Agent" internship on askThili, with an AI mentor beside you.

Start the internship: https://ask.thili.ai/courses/lfagents-lfsql?utm_source=youtube&utm_medium=video&utm_campaign=bug-cards

#AIAgents #SQL #Python #AISafety #LLM #askThili