SQL can do more than query data. Now, it can call AI models, execute Python functions, and run agents in secure sandboxes, all within a single query.

Most teams will recognize a familiar workflow: query your data, move it somewhere else, run your computation, and bring the results back.

But that creates friction when you want to run custom code or AI agents across large datasets. Writing the function is often the easy part. Orchestrating, scaling, and observing millions of executions is much harder.

At ClickHouse Developer AI Night, Elliot, co-founder of Chalk, demonstrated a different approach: using SQL to orchestrate AI agents and Python functions at scale, without moving data out of the systems where it already lives. 150+ engineers watched one SQL query do something that SQL doesn't usually do.

Here’s how it worked.

From a SQL query to AI model calls

Start with a simple query against a ClickHouse table. But instead of stopping at selecting and filtering rows, Elliot showed how Chalk can extend SQL to perform much more:

• Call AI models: Send prompts to OpenAI through Chalk’s model router.
• Execute Python functions: Run custom logic against individual rows as part of a query.
• Make HTTP requests: Fetch external data with configurable rate limits.
• Run code in sandboxes: Start isolated computing environments, execute commands, and securely manage access to resources.

Each operation becomes part of the same SQL execution pipeline.

Hunting for vulnerabilities with agents

What if you wanted to scan multiple Python repositories for potential security vulnerabilities?

Instead of building a separate ingestion pipeline, processing system, and agent infrastructure, Elliot demonstrated how to orchestrate the entire workflow through SQL.

The process:

1. Query ClickHouse for Python package repositories.
2. Pass repository URLs into a custom Python function.
3. Start a secure sandbox for each repository.
4. Run an AI agent inside the sandbox to investigate potential CVEs.
5. Route model calls through Chalk.
6. Return the agent’s findings directly to the original SQL query.

The agent investigated each repository and returned potential vulnerabilities, including a possible shell command injection involving os.system.

But the particularly interesting part wasn’t just the findings. It was the execution trace.

The entire workflow was observable through a single connected trace.

Elliot showed how to follow the execution from the original SQL query to the Python function, sandbox, agent conversation, and individual model calls.

No disconnected logs or separate tracing systems to piece together what happened.

What makes this possible with Chalk?

1. Your data stays where it lives.

Chalk is a federated query engine. It connects to existing data sources like ClickHouse, Snowflake, and PostgreSQL instead of requiring companies to copy everything into another system. It also pushes filters and column selection down to the underlying data sources.

2. Python functions become part of your query plan.

You can write custom Python functions and execute them as part of SQL. Simple functions can even be transpiled into expressions and pushed down into the underlying database.

3. AI agents can run securely and at scale.

Chalk orchestrates sandboxed execution, manages resources, and controls concurrency. In the demo, Elliot configured execution with a concurrency limit of 25, allowing multiple repository investigations to run in parallel.

4. Everything is observable.

From SQL execution to sandbox activity and individual model calls, the entire execution chain is connected. You can inspect what an agent did, what data it processed, and how it reached its result.

Beyond security scanning

The same architecture applies to much more than finding vulnerabilities. Any workflow that requires running custom code or AI agents across large datasets can benefit from this approach.

• Data enrichment: Run AI models across millions of customer, company, or product records to classify, extract, and enrich information without building separate processing pipelines.
• Fraud and risk investigation: Launch agents to investigate suspicious transactions, pull in additional context from external sources, and return findings directly to SQL for further analysis.
• Document processing: Use Python functions and AI models to extract structured information from contracts, invoices, or support tickets, then join the results with existing database records.
• Agent evaluation: Run agents against historical datasets, score their outputs, and compare performance across models, prompts, or agent configurations at scale.

The common thread: SQL selects the data, Python and agents perform the work, and the results flow back into the query, with execution managed and observable in one place.

Don’t choose between the flexibility of Python and the scale of SQL.

With Chalk, you can bring data, custom functions, AI inference, sandboxed execution, and evaluations into one query execution layer.

Thanks to everyone at ClickHouse Developer AI Night for having us! If you’re interested in learning more about Chalk’s agent runtime and database engine, reach out to chat with an engineer here.