Why a Missing WHERE Clause in AI-Generated SQL Is a Data-Leak Security Risk

·1 views

In multi-tenant SaaS platforms, tenant data isolation has traditionally relied on developers manually appending a workspace filter to every database query. This approach held up when a small, fixed set of hand-reviewed API endpoints handled all data access. However, the rise of AI-powered 'ask your data' copilot features means a language model now generates SQL dynamically at runtime, with no human reviewing each query before it executes. A missing tenant filter in model-generated SQL does not produce an error — it silently returns another customer's data, rendering correctly as a chart or plain-language answer. Security experts warn this makes the copilot a high-risk surface where the tenant boundary must be enforced at the database or query-engine layer, not left to application logic or model memory.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser Use integrates with Scrapeless to run AI agents in anti-detection cloud browsers

Browser Use, a framework that lets large language models control a real browser, can now be connected to Scrapeless's cloud-based Scraping Browser via a single WebSocket endpoint using the Chrome DevTools Protocol. The integration addresses a core problem with local browser automation: headless Chromium exposes telltale signals such as the navigator.webdriver property, default headless fingerprints, and a traceable IP address that anti-bot systems routinely flag. By pointing the cdp_url parameter to Scrapeless, developers offload the browser runtime, fingerprint management, and residential IP routing to the cloud without changing any agent logic. The setup requires only a Scrapeless API key and supports session-level proxy country selection across more than 195 regions. New Scrapeless accounts receive free Scraping Browser runtime to get started at no initial cost.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

xAI and Cursor Set to Launch Joint AI Coding Model, Delayed for Efficiency Gains

xAI and Cursor, now operating under SpaceX's umbrella following a $60 billion all-stock acquisition of Cursor's parent company Anysphere in June, are preparing to release their first jointly developed AI model as early as Wednesday. The launch was pushed back by roughly two days — not due to capability issues, but to improve the model's processing efficiency and cost-effectiveness. According to a staff memo reported by The Information, the model is designed to handle information quickly and is said to be competitive with Anthropic's Opus 4.8 and OpenAI's GPT 5.5 in certain respects, though no benchmarks or pricing details have been released. The collaboration addresses a key constraint Cursor previously faced: limited access to computing power, which had been identified as a ceiling on its growth as an AI coding tool. With SpaceX's compute resources now backing the product, the joint model is expected to make Cursor a more vertically integrated and cost-competitive offering in the enterprise AI coding market.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Swiss compliance site releases two open datasets on wages and SME deadlines

A developer building Canton Compliance Hub, a free multilingual resource for small businesses in Switzerland, has published two structured datasets under the CC BY 4.0 license. The first dataset covers minimum wage rules across all 26 Swiss cantons and three cities, reflecting the country's lack of a national pay floor and sourcing figures from cantonal, municipal, and federal pages. The second dataset outlines 12 recurring federal compliance deadlines that Swiss SMEs must meet annually, including VAT returns, AHV declarations, and withholding tax obligations. Each row in both datasets includes a verified source URL, ensuring figures can be independently checked without relying on the publisher. The datasets are available in both CSV and JSON formats, with the JSON version serving as the multilingual source of truth from which the flat CSV is automatically generated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DIY Builder Constructs 8,192-Core GPU Using 13-Cent RISC-V Microcontrollers

A hardware enthusiast known as Bitluni has built a custom GPU by connecting 8,192 WCH CH570 RISC-V microcontrollers, each costing about $0.13, into a single parallel computing array. The project originated from a bulk chip purchase left over from earlier cluster experiments. Each CH570 chip runs at up to 100 MHz with 12 KB of SRAM, with groups of 32 reporting to larger controller chips to simplify communication. The build required six-layer PCBs, individual crystals per chip after a shared clock scheme failed, modular blade boards connected via PCIe edge connectors, and a 3 kW power supply delivering over 650 A on a 3.3 V rail. Firmware was flashed automatically using a pogo-pin fixture mounted on a printer toolhead guided by a Python script.

0 comments Read more at DEV Community