Author(s): Shoaib Ahmed Quraishi

Originally published on Towards AI.

The AI Stopped Hackers. It Couldn’t Handle O’Brien.

An AI system correctly blocked a deliberate SQL injection attack — and then broke on someone named O’Brien.

After running a local LLM evaluation suite that translates plain-English requests into SQL for a fixed HR schema, the author found that classic malicious prompt testing worked—but a “boring” real-world input exposed a serious gap. A normal name containing an apostrophe (O’Brien) caused the model to generate broken SQL, showing that blocking known SQL-injection patterns is not the same as producing safe, correctly escaped queries. The author also observed inconsistent refusals for a legitimate request (“show me every employee across all locations”), emphasizing that LLM behavior can be nondeterministic and that single-run results can be misleading. The most important lesson came when the evaluator itself was wrong: the AI judge reported a missing clause even though deterministic checks proved it was present, highlighting the need to verify judge outputs, especially for “LLM-as-a-judge” setups. Overall, the post argues that traditional QA discipline—edge cases, deterministic assertions, repeated sampling, and independent cross-checks—still applies directly when testing AI systems, particularly where ordinary inputs and self-graded evaluations can produce costly false positives.

Read the full blog for free on Medium.

Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.

Published via Towards AI