1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. The dominant risks concentrate in supply chain configuration vectors, the unfiltered MCP inter-agent protocol, and the absence of default input or output guardrails across all channels.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. dbt Copilot sits in the lower-risk bands with vendor-documented platform controls offsetting a narrow but evidence-backed attack surface concentrated in supply chain and inter-agent vectors.
The moderate attack surface and contained blast radius place the agent in the lower-left quadrant, where platform-level isolation and metadata-only access keep the composite risk below the median despite sparse default defense controls.
Each metric anchors the composite on a different denominator: attack surface and blast radius on a ten-point scale, defense controls on fifteen, and the AIRQ composite on their product.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 3.75 | Anchored by vendor security documentation, agent-specific GHSA advisories against the MCP server, and NVD CVEs against the underlying dbt-core platform components. |
| Blast Radius | 3.75 / 10 | Held in the lower bands by the cloud platform's metadata-only AI boundary and project-scoped warehouse authority, with no demonstrated host-level escalation path. |
| Attack Surface | 4.8 / 10 | Evidence spans supply chain advisories, MCP protocol injection findings, and vendor-documented configuration defaults across the cloud and local deployment modes. |
| Defense Controls | 7 / 15 | Platform-level tenant isolation and opt-in SQL execution gating provide the floor, but absent input filtering and output monitoring leave most control components in the lowest bands. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The dominant exposures are the supply chain configuration surface through public dbt packages and the unvalidated MCP inter-agent channel, both carrying agent-specific evidence of exploitation.
One surface reaches the upper band through agent-specific evidence and two more carry demonstrated penalties, while the remaining seven sit at the low-to-moderate architectural baseline.
Each row ties the architectural exposure to the strongest available evidence anchor, with bracket citations resolving to the references at the end of the profile.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Accepts natural language prompts through the cloud IDE and MCP tool calls without a dedicated prompt shield or injection detection on either channel by default. [9][14] |
| External Data | 2 / 4 | Ingests dbt project metadata, model SQL, and warehouse schema information to generate context for AI responses, with no content validation layer on inbound project files. [9] |
| Memory | 1 / 4 | No persistent cross-session memory by default; dbt project state and metadata provide session context only, limiting the memory attack surface to project-scoped artifacts. [9] |
| Reasoning | 2 / 4 | The AI reasoning loop processes warehouse metadata and user prompts through an LLM with no chain-of-thought filtering or intermediate-step validation visible in the documented architecture. [9][11] |
| Planning | 2 / 4 | Model generation and refactoring follow a fixed workflow pattern without multi-step autonomous planning beyond the immediate task scope defined by the user prompt. [9][16] |
| Tool Execution | 2 / 4 | The MCP server wraps dbt CLI commands including model compilation and optional SQL execution against the connected warehouse with operator-level credentials. [14][15] |
| Orchestration | 2 / 4 | Single-agent architecture in the cloud deployment; the MCP server enables external orchestration through tool calls but does not autonomously spawn or coordinate child agents. [14] |
| Inter-Agent | 3 / 4 | The MCP server CLI wrappers accepted crafted node_selection and resource_type parameters that could inject arbitrary dbt global flags and redirect the profiles directory to attacker-controlled configuration. [7] |
| Output Processing | 2 / 4 | Unredacted dbt command parameters and SQL content flowed to vendor telemetry endpoints by default before the MCP server patch, exposing sensitive query payloads without operator consent. [6] |
| Configuration | 4 / 4 | A malicious dbt package can silently override built-in materializations to inject arbitrary SQL into the compilation pipeline, exploiting the default implicit override behavior before the explicit-override flag was introduced. [1][2][8] |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. dbt Copilot exhibits all three on the documented default: user prompts and third-party package content feed the reasoning loop, warehouse metadata and credentials are accessible, and prompts plus tool arguments transmit to external API endpoints.
dbt Copilot exhibits all three of these conditions in its documented default configuration:
- Untrusted input — User prompts and dbt project files from public package registries enter the reasoning loop without content filtering, and the MCP server accepts tool calls from external agents. [9][14]
- Sensitive data — The copilot accesses warehouse metadata including column names, table schemas, model SQL, and project lineage through platform-managed database credentials. [9][11]
- External egress — Prompts and metadata transmit to the LLM provider via API, and MCP server tool arguments were sent to vendor telemetry by default before patching. [6][11]
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. The blast radius is bounded by metadata-only cloud access and warehouse-scoped credentials, with the highest exposure concentrated in network egress and credential reach through the data warehouse connection.
No factors reach the upper bands; four of six sit at the low baseline, with network and credential exposure carrying the highest individual scores in the moderate range.
Each factor ties a compromise scenario to the documented capabilities and credential scopes the agent inherits from its platform connection and deployment mode.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 1 / 4 | Cloud deployment restricts execution to dbt model compilation and SQL queries when explicitly enabled by the administrator; no arbitrary host code execution is available by default. [9] |
| File system access | 1 / 4 | Cloud access is limited to dbt project files and metadata within the platform boundary; the local MCP server accesses the full project directory on the host, and a patched path traversal could write to sibling directories through crafted tarballs. [4][14] |
| Network access | 2 / 4 | Outbound connections reach the LLM provider API and vendor telemetry endpoints by default, with the MCP server enabling additional network access through SQL execution against remote warehouses. [11][14] |
| Credential access | 2 / 4 | The platform manages warehouse connection credentials; the agent inherits read access to schema metadata and optional write access through SQL execution within the configured database scope. [9][12] |
| Autonomous action | 1 / 4 | The Developer agent builds and refactors models autonomously but operates within the dbt Cloud project boundary with no cross-system or cross-environment action capability by default. [16] |
| Deployment access | 2 / 4 | The agent can compile and run dbt models that affect warehouse state within the configured environment but has no deployment pipeline or infrastructure provisioning authority. [9][14] |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The cloud platform provides tenant-scoped execution isolation and gated SQL execution as default controls, while input filtering, output monitoring, and structured audit logging remain absent or operator-configured.
Higher scores reflect stronger vendor safeguards; execution isolation and action controls carry moderate scores while input filtering and output monitoring remain absent or minimal.
Each component is scored on the vendor-documented default posture, with opt-in configurations noted as hardening recommendations rather than counted toward the default defense score.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | No dedicated prompt filter, injection detection, or content validation layer runs on user prompts or MCP tool call inputs by default in either deployment mode. [9][14] |
| Execution Isolation | 2 / 3 | The cloud platform provides tenant-scoped isolation with metadata-only AI access and warehouse sandboxing; the local MCP server runs without process-level containment on the host. [9][14] |
| Action Controls | 2 / 3 | SQL execution through the MCP server is disabled by default and requires explicit opt-in; the Developer agent operates within project boundaries with human review supported but not enforced by default. [12][16] |
| Output Guardrails | 0 / 3 | No output filtering, data-loss prevention, or structured output validation is documented for AI-generated responses, tool call results, or telemetry payloads in the default configuration. [9] |
| Monitoring | 2 / 3 | Job-level logging and lineage tracking through dbt Explorer are available; SOC 2 Type II and ISO 27001 certifications are current, but no dedicated AI-action audit trail is published. [10][13] |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. The highest-leverage changes are enabling explicit package overrides, restricting MCP server tool categories, and deploying structured AI action logging across all deployment modes.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require all third-party dbt packages to pass an internal security review before deployment — counters Configuration surface exposure from malicious package override attacks.
- Configuration Enable the explicit package overrides flag in dbt_project.yml to block silent materialization overrides from untrusted packages — counters Configuration at the upper band.
- Engineering Deploy prompt injection detection at the MCP server tool call handler and the cloud IDE prompt path before requests reach the LLM — counters User Input exposure from unfiltered channels.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Restrict MCP server deployments to remote mode connected through the cloud platform rather than local host mode — counters Execution Isolation gaps in local deployments.
- Configuration Disable SQL execution and code generation tool categories in the MCP server configuration unless explicitly required — counters Tool Execution authority in the default MCP setup.
- Engineering Wrap local MCP server processes in a container or sandbox with read-only project access — counters file system exposure from unrestricted host-level project directory access.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Establish an approval workflow requiring human review of all Developer agent-generated model changes before warehouse deployment — counters Autonomous Action in the default workflow.
- Configuration Configure the MCP server with the most restrictive tool category set matching each integration use case — counters the broad default tool authority inherited by connected agents.
- Engineering Integrate dbt CI checks with automated SQL review that blocks destructive operations before warehouse execution — counters credential and deployment blast from unsupervised SQL runs.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Define a data classification policy identifying sensitive metadata fields and establish redaction rules for AI-generated outputs — counters Output Processing exposure from unfiltered responses.
- Configuration Disable telemetry transmission in MCP server configuration to prevent unredacted tool arguments from reaching external endpoints — counters the telemetry credential leakage vector.
- Engineering Build a structured output filter that strips credential fragments and sensitive schema names from AI responses before delivery — counters the absence of default output validation.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require centralized logging of all AI copilot interactions including prompt content and tool call parameters in the security information management pipeline — counters Monitoring gaps.
- Configuration Forward dbt Cloud job logs and MCP server audit events to the enterprise SIEM for correlation with warehouse access patterns — counters the absent AI-specific audit trail.
- Engineering Build an alerting pipeline that flags anomalous SQL patterns, unusual metadata access volumes, or configuration path changes from AI-initiated tool calls — counters Monitoring at the current band.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2024-40637 Malicious dbt package can override built-in materializations for supply chain SQL injection and data exfiltration. Patched in dbt-core 1.8.0.
- GHSA-p3f3-5ccg-83xq The vendor advisory documents the materialization override vector and the require_explicit_package_overrides mitigation flag.
- CVE-2026-29790 Path traversal in dbt-common safe_extract allows malicious tarballs to write files to sibling directories. Patched in dbt-common 1.34.2.
- GHSA-w75w-9qv4-j5xj The vendor advisory documents the commonprefix-to-commonpath fix and limited practical risk when packages come from trusted sources.
- CVE-2026-39382 Command injection in a reusable GitHub Actions workflow via unsanitized comment body can exfiltrate CI secrets. Fixed in the dbt reusable CI workflow repository.
- CVE-2026-44970 The dbt MCP server logs unredacted tool arguments including SQL and credentials to plaintext files and transmits them to telemetry by default. Patched in dbt-mcp 1.17.1.
Selected Research
- dbt MCP argument injection Crafted node_selection parameters inject arbitrary dbt global flags including profiles-dir redirection in the MCP server CLI wrappers.
- dbt supply chain SQL injection writeup Independent researchers demonstrated data exfiltration from BigQuery via a malicious dbt package that silently overrides materializations.
Vendor Documentation
- About dbt Copilot The vendor documents dbt Copilot as an AI-powered assistant that gathers metadata without accessing row-level warehouse data and sends prompts to the LLM provider.
- dbt Security and Compliance The vendor security page documents encryption standards, access controls, annual penetration testing, and certifications including SOC 2 Type II and ISO 27001.
- dbt Labs AI Principles The vendor AI principles page details the Client Data vs Platform Data distinction and prohibits third-party model training on client data.
- Enable dbt Copilot The vendor documentation describes the default managed LLM key, bring-your-own-key options for Enterprise plans, and the explicit admin enablement requirement.
- dbt Labs ISO certifications The vendor announces ISO 42001 AI governance certification alongside expanded ISO 27017 and ISO 27018 certifications complementing ISO 27001.
Other Sources
- dbt MCP server documentation The MCP server documentation describes local and remote server modes, available tool categories, and the architecture enabling AI agents to interact with dbt projects.
- dbt MCP server repository The open-source repository includes tool documentation, security warnings about potential data modification, and the complete release history.
- Developer agent documentation The Developer agent documentation describes autonomous model building, refactoring, testing, and documentation capabilities powered by agent skills.