Securing the Future of AI: Systematization of Knowledge for MCP

Supabase Data Leak (2025)

A developer used an AI assistant (Claude via Cursor IDE) connected to a Supabase database through MCP. An attacker, posing as a normal user of a support ticket system, embedded a malicious instruction inside a support ticket message. This instruction was crafted to look like a message for the AI agent, telling it to leak the contents of a sensitive database table (integration_tokens). The support workflow was such that the human support agent never saw this hidden directive (it was just stored as data), and due to role-based access controls, the human agent couldn't access the sensitive table anyway. However, when the developer later asked the AI assistant to show the latest ticket, the AI pulled in the attacker's message as part of the context. The LLM confused data for a command – it dutifully executed the SQL queries as instructed, since it had the powerful service_role credentials, bypassing all security policies. The result: the secret tokens were extracted and inserted into the ticket conversation, immediately visible to the attacker in the user interface.

• Isolation of Instructions vs Data: Systems must clearly delineate between executable instructions and just content. Sanitize tool descriptions and user-provided data.
• Principle of Least Privilege: AI agents should operate with minimally scoped credentials (e.g., read-only) to limit damage.
• Audit and Monitoring: Implement monitoring to flag unusual behavior (e.g., AI accessing sensitive tables) and output sanitizers to prevent data exfiltration.