In July 2026, AISLE researchers disclosed eight vulnerabilities across MySQL, MariaDB, and PostgreSQL. These flaws were identified using the company’s autonomous Cyber Reasoning System (CRS). The databases affected serve as the infrastructure for AI agent backends, vector stores, and state management systems.
CVE-2026-6638 in PostgreSQL illustrates the risks within complex database operations. This SQL injection vulnerability occurs during the execution of the ALTER SUBSCRIPTION … REFRESH PUBLICATION command. PostgreSQL also contained CVE-2026-6473, an integer wraparound issue leading to undersized allocations and out-of-bounds writes, carrying a CVSS score of 8.8.
MariaDB vulnerabilities included an argument injection in the CONNECT storage engine and an authorization bypass in role-based routine-level privilege checks. MySQL findings included a Group Replication issue where a malformed state-exchange message causes a hang or crash (CVE-2026-34271, CVSS 7.1), and a resource allocation flaw in libmysqlclient.
AISLE’s CRS methodology utilizes a multi-stage pipeline: an analysis agent inspects source code for vulnerabilities, followed by a patch generation module that produces repository-native fixes. A Verifier Agent then validates these patches within Docker images. This system has previously identified 12 OpenSSL CVEs and 38 OpenEMR CVEs.
As AI agents are integrated into enterprise workflows, they are tasked with defending the infrastructure they rely upon. By identifying and facilitating the patching of vulnerabilities in databases, these autonomous systems are hardening the foundation of the AI agent stack.