EE
FR Contact

Support-ticket prompt injection makes Cursor agent leak private tables via Supabase MCP

Proof of concept Manipulation Severity 3 significant Reported 70% Disputed

General Analysis built a demo support app on Supabase and showed that a customer could plant instructions in a support ticket; when the developer asked Cursor's agent, connected through the Supabase MCP server with service_role access, to list recent tickets, the agent read a private integration_tokens table and copied its contents into the ticket thread where the customer could see them. The test used dummy data. Supabase said no customer had reported a data leak via MCP and pointed to read-only, project-scoped modes it had introduced.

Because the service_role bypasses row-level security, the agent could read any table while also processing customer-written text. Simon Willison described the setup as a 'lethal trifecta' contained in a single MCP server.

Disputed. Supabase says MCP does not bypass row-level security, noting the demo ran with a higher-privileged role, and that no customer has reported a leak via MCP.

What would have stopped it

Connect agents to databases read-only and with a narrowly scoped role, never the service role.

Guardrails

2 of 8 failed
  1. G1 Least privilege Failed The agent connected with service_role privileges that bypass all row-level security.
  2. G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed The agent treated instructions inside customer-submitted ticket text as commands.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 1 specialist
  1. Supabase MCP can leak your entire SQL database General Analysis, 8 Jul 2025
    “In our July 2025 demonstration, instructions planted in the ticket connected those two permissions: the assistant read sensitive dummy data and copied it into a reply the customer could see.”
    Primary Quote checked Archived copy
  2. Defense in Depth for MCP Servers Supabase, 16 Sep 2025
    “MCP does not “bypass” our database-level protections like Row Level Security (RLS) - these remain fully enforced.”
    Primary Disputes Quote checked Archived copy
  3. Supabase MCP can leak your entire SQL database Simon Willison’s Weblog, 6 Jul 2025
    “The cursor assistant operates the Supabase database with elevated access via the service_role, which bypasses all row-level security (RLS) protections.”
    Specialist Quote checked Archived copy

Confidence 70% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2025-014 May 2025 Malicious GitHub issue hijacks agents using GitHub's MCP server to leak private repo data GitHub MCP serverProof of conceptSwitzerland 89%
  2. EEAIR-2026-001 Jan 2026 Hundreds of malicious ClawHub skills for OpenClaw agents deliver infostealer malware OpenClaw with ClawHub skills 91%
  3. EEAIR-2025-044 Dec 2025 PromptPwnd: issue text can hijack AI agents in GitHub Actions to leak repository secrets AI agents in CI/CD workflows (Gemini CLI, Claude Code Actions, OpenAI Codex, GitHub AI Inference), Google; Anthropic; OpenAI; GitHubProof of conceptEU 92%