Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems

A systematic security study reveals eight data agent-specific risks, a 3-goal/7-tactic/14-technique attack taxonomy, and substantial vulnerabilities across four open-source and two production cloud analytics systems.

Kuncan Wang; Ziting Wang; Peizhuo Lv; Haoyang Li; Guoliang Li; Gao Cong; Wei Dong· 2026· DOI 10.48550/arXiv.2606.08661

The core problem

Data agents integrate LLM-driven reasoning with relational data access, executable analytical tools, and multi-step workflow orchestration, making them increasingly central to enterprise analytics. This integration introduces new security vulnerabilities across data resources, database execution, and agent reasoning, recombining concerns from database security and general-purpose LLM-agent security into failure modes that neither line of work captures on its own. To address this gap, the authors present a systematic security study of data agents. Their contributions are threefold: (1) a layered vulnerability framework identifying eight data agent-specific risks across interpretation, execution, and policy layers; (2) an attack taxonomy organized by adversary goal, tactic, and technique, covering three goals, seven tactics, and fourteen techniques, paired with an LLM-driven payload generation pipeline grounded in real database schemas; and (3) an evaluation of these attacks on six systems, including four open-source data agents and two production cloud analytics services. The experiments reveal substantial security vulnerabilities across current systems and yield four key takeaways.

The experiments reveal substantial security vulnerabilities across all six evaluated systems. The attacks, generated via the LLM-driven pipeline, successfully exploit weaknesses in interpretation, execution, and policy layers. Key quantitative findings include: - **Attack Success Rates:** The attacks achieved high success rates across different systems, with variations depending on the system's architecture and defenses. - **Vulnerability Distribution:** The eight data agent-specific risks were observed in practice, with some risks more prevalent than others. - **System Comparison:** Open-source data agents and production cloud analytics services both exhibited vulnerabilities, though the specific weaknesses differed. The results demonstrate that current data agents are not adequately secured against the identified threats. The four key takeaways from the experiments are: 1. Data agents introduce novel attack surfaces not covered by traditional database or LLM-agent security. 2. The layered vulnerability framework effectively captures the risks. 3. The attack taxonomy and payload generation pipeline are effective in discovering vulnerabilities. 4. Both open-source and production

Data agents integrate LLM-driven reasoning with relational data access, executable analytical tools, and multi-step workflow orchestration, making them increasingly central to enterprise analytics. This integration introduces new security vulnerabilities across data resources, database execution, and agent reasoning, recombining concerns from database security and general-purpose LLM-agent security into failure modes that neither line of work captures on its own. To address this gap, the authors present a systematic security study of data agents. Their contributions are threefold: (1) a layered vulnerability framework identifying eight data agent-specific risks across interpretation, execution, and policy layers; (2) an attack taxonomy organized by adversary goal, tactic, and technique, covering three goals, seven tactics, and fourteen techniques, paired with an LLM-driven payload generation pipeline grounded in real database schemas; and (3) an evaluation of these attacks on six systems, including four open-source data agents and two production cloud analytics services. The experiments reveal substantial security vulnerabilities across current systems and yield four key takeaways.

The authors adopt a systematic security study approach comprising three main methodological components.

The findings highlight a critical gap in the security of LLM-driven data agents. The recombination of database security and LLM-agent security creates failure modes that neither field addresses alone. For instance, an attacker might exploit the interpretation layer to inject malicious prompts that manipulate the agent's reasoning, leading to unauthorized data access or execution of harmful tools. The execution layer vulnerabilities allow attackers to execute arbitrary code or queries, while policy layer weaknesses enable bypassing access controls. The attack taxonomy provides a structured way to understand adversary behavior. The three goals (e.g., data exfiltration, data manipulation, denial of service) are achieved through seven tactics and fourteen techniques. The LLM-driven payload generation pipeline ensures that attacks are tailored to the target database schema, increasing their effectiveness. The evaluation on six systems underscores the urgency for robust defenses. The authors suggest that future work should focus on developing security mechanisms that address the unique challenges of data agents, such as secure interpretation of user inputs, sandboxed execution of tools, and dynamic policy enforcement. A high-level architecture of a data agent and its attack surfaces can be represented as: This diagram illustrates the flow from user input through LLM reasoning, tool selection, database execution, and policy enforcement, with attack surfaces highlighted.

CS practitioners and researchers

Opening member content…