Oracle connects AI-driven testing with a new approach to database security

AI-driven testing is driving database providers to speed up patch cycles, while real application testing acts as a safeguard to prevent production system disruptions. This AI wave is also challenging security rules embedded in applications. Oracle has tackled the issue from two angles: hardening its code against external threats and moving agent controls to the data layer.

The company initially tested its own software with an early-access frontier model named Mythos, which quickly identified numerous security vulnerabilities. Loaiza emphasized that the situation was critical, likening it to a "code red moment."

Most of Oracle's response to these AI-discovered vulnerabilities will be incorporated into regular quarterly patches, which have become significantly larger. In an earlier security update, Oracle addressed over 1,400 vulnerabilities across its software lineup. While customers must automate patching and stay updated, each large patch poses the risk of system regressions due to the complexity of applications that perform critical functions.

To address this, Oracle introduced Real Application Testing, which captures real workload data and runs it to ensure that patches do not negatively impact systems. However, patching addresses only external threats. Internal AI use is another concern, as applications traditionally enforced end-user security. AI now generates some of this security code or directly interacts with the data layer.

Oracle's solution to this is Deep Data Security, launched in April. This technology passes an authenticated user's identity as an encrypted token through the database, extending authorization controls to remote databases, lakehouse data, and related tables.

Loaiza described the new security landscape as requiring end-user security rules to be enforced where AI cannot bypass them, which means implementing these rules down to the data layer. AI agents, acting on behalf of authenticated users, must also comply with these rules and cannot leak data that they cannot see. Similarly, business rules must be enforced consistently, regardless of the access mechanism or AI involvement.

Oracle provides declarative methods for defining such rules and SQL Assertions to validate changes made through SQL queries.

By moving these rules all the way down into the data layer, Oracle aims to ensure that no matter how data is accessed—whether through traditional methods or AI technologies—the underlying business rules cannot be violated.