Case supabase-mcp-cursor-token-leakPrompt injectionUnited States
Support ticket prompt injection makes Cursor plus Supabase MCP dump integration tokens
General Analysis showed a support ticket with hidden instructions could make a Cursor agent, connected to Supabase via MCP with a service role, read the integration_tokens table and write the secrets into the ticket.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 6, 2025
- Location
- United States
- Target
- Supabase MCP server used from Cursor
- Severity
- Medium
- Triggered by
- General Analysis
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
General Analysis showed a support ticket with hidden instructions could make a Cursor agent, connected to Supabase via MCP with a service role, read the integration_tokens table and write the secrets into the ticket.
Impact: Demonstrated exfiltration of integration tokens from a test project; pattern applies to any agent with service-role database access
Who triggered it
Actor: General Analysis
Attribution: Public proof of concept; Supabase responded with documentation and default changes
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in user-submitted ticket text processed by an agent with privileged database access and write capability
Root cause: MCP connection ran as a role that bypassed row-level security and could both read private tables and write attacker-visible records
Timeline
- General Analysis publishes the demonstration
- Supabase makes read-only, project-scoped mode the documented default
Response
Supabase recommended read-only mode and added guidance; no customer breach reported
Current status: Patched
Sources (open in a new tab)
- Simon Willison simonwillison.net
- Simon Willison link blog feeds.simonwillison.net
Cite this case
Support ticket prompt injection makes Cursor plus Supabase MCP dump integration tokens. AI Threat Watch, case supabase-mcp-cursor-token-leak, Jul 6, 2025. https://aithreat.io/cases/supabase-mcp-cursor-token-leak/
Permanent link: https://aithreat.io/cases/supabase-mcp-cursor-token-leak/