I'm also thinking of attacks similar to the recent okta attack where they gained access through a support employee. I could see trying to get queries like this

I'm also thinking of attacks similar to the recent okta attack where they gained access through a support employee. I could see trying to get queries like this to show up in their internal tooling, show up in a support ticket, or somewhere like that. Then the first time it's executed to see what the issue could be, it can exfiltrate any data it has access to!