An organization's AI red team is tasked with finding vulnerabilities in an LLM-powered agent that has access to internal databases and can execute SQL queries. Which attack scenario represents the HIGHEST severity risk?

B is correct because an agentic AI with database write/delete access that can be manipulated to execute destructive SQL commands represents a catastrophic integrity and availability risk. This combines prompt injection (the attack vector) with real-world system access (the blast radius). Grammatically incorrect responses (A) are quality issues with minimal harm. System prompt extraction (C) is a moderate confidentiality risk. Refusal to answer (D) is a service availability issue. B has both high likelihood of exploitation and catastrophic impact.