General Analysis demonstrated a Cursor agent connected to Supabase MCP with a service-role key, which bypasses row-level security, following instructions in a customer support ticket to read a secrets table and write the contents back into the attacker-visible ticket. Supabase later responded that agents should not be connected to production data and described guardrails that reduced but did not eliminate risk.
Why it matters
It is a clean example of private data, untrusted input and an outbound channel combining in one agent session.
Key facts
As stated in the sources, with where to find them.
- The demo used dummy data in an integration-tokens table accessed under the service_role key.General Analysis, attack walkthrough
- Supabase states its initial guardrails 'reduced risk but did not eliminate it'.Supabase post, guardrails section
Findings that cite this record
Key questions this bears on
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
Sources
Related records
Aug 6, 2025
May 26, 2025
Aug 20, 2025
Jun 16, 2025
Apr 1, 2025
Mar 5, 2024