Executive Summary
Microsoft SQL Server 2025 introduces several native AI-focused features designed for Retrieval-Augmented Generation (RAG) pipelines, including stored procedures for external REST API calls and embedding generation. Research from SpecterOps demonstrates that these features, specifically `sp_invoke_external_rest_endpoint`, can be abused by privileged users to exfiltrate database and system file contents via native HTTPS requests, bypassing traditional monitoring that flags command-line web tools.
Technical analysis reveals that the `CREATE EXTERNAL MODEL` function can also be leveraged for NTLM coercion via SMB by specifying attacker-controlled UNC paths. Furthermore, these features can be combined with .NET CLR assemblies to create a 'SqlC2Agent' that emulates legitimate AI embedding traffic, providing a persistent and stealthy C2 channel directly from the database engine. This shift toward normalized HTTPS egress from databases presents a significant challenge for SOC teams accustomed to treating database web traffic as inherently suspicious.