Support ticket text steers a coding agent into leaking private database tables

Timeline

• 2025-07-08. General Analysis publishes its demonstration.
• 2025-09-16. Supabase publishes its approach to securing MCP.

Trigger or entry point

A customer support ticket that contains instructions addressed to the developer’s agent.

Failure mechanism

A developer asks the agent in Cursor to show the latest open ticket. The agent reads the ticket through the Supabase MCP server and follows the instructions in it. The MCP server runs SQL with the service_role key, which bypasses row-level security. The agent reads a table of integration tokens and inserts its contents as a new message in the ticket, where the attacker can read it. Each step on its own was an ordinary action for the agent: reading a ticket, running a query, writing a message. The developer only asked to see the latest ticket.

Impact

The demonstration used a new project with dummy data. Supabase states that there has been “no reported incident” of a customer leaking data through MCP. The severity is potential.

Response

Supabase wrote that its guardrails reduced the risk but did not eliminate it. It added that “guardrails alone aren’t enough” and described further work, including more granular access token scopes and a mode intended for production use.

Mitigations

Supabase lists a read-only mode, scoping the server to one project, manual approval of tool calls, and using MCP with non-production data. It also recommends monitoring and logging the queries that MCP clients run.