AI agent SQL injection hides in one seam: how the SQL string is built. agent_sql_seam.py is a static ast detector that flags f-strings reaching a DB sink.