Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supabase MCP can leak your entire SQL database

generalanalysis.com

Post reply on HN
Print view View original

351–360 of 502 posts

Re: Supabase MCP can leak your entire SQL database

#351

Post by benreesman »

tptacek wrote: post #68
gregnr wrote: post #43

Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections: - Encourage folks to use read-only by default in our docs [1] - Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2] - Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2] We noticed that t…

Can this ever work? I understand what you're trying to do here, but this is a lot like trying to sanitize user-provided Javascript before passing it to a trusted eval(). That approach has never, ever worked. It seems weird that your MCP would be the security boundary here. To me, the problem seems pretty clear: in a realistic agent setup doing automated queries against a production database (or a database with produc…

No it can't ever work for the reasons you mention and others. A security model will evolve with role-based permissions for agents the same as users and service accounts. Supabase is in fact uniquely positioned to push for this because of their good track record on RBAC by default.

There is an understandable but "enough already" scramble to get AI into everything, MCP is like HTTP 1.0 or something, the point release / largely-compatible successor from someone with less conflict of interest will emerge, and Supabase could be the ones to do it. MCP/1.1 is coming from somewhere. 1.0 is like a walking privilege escalation attack that will never stop ever.

Re: Supabase MCP can leak your entire SQL database

#352

Post by graealex »

tptacek wrote: post #68
gregnr wrote: post #43

Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections: - Encourage folks to use read-only by default in our docs [1] - Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2] - Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2] We noticed that t…

Can this ever work? I understand what you're trying to do here, but this is a lot like trying to sanitize user-provided Javascript before passing it to a trusted eval(). That approach has never, ever worked. It seems weird that your MCP would be the security boundary here. To me, the problem seems pretty clear: in a realistic agent setup doing automated queries against a production database (or a database with produc…

It already doesn't work if you have humans instead of an LLM. They (humans) will leak infos left and right with the right prompts.

Re: Supabase MCP can leak your entire SQL database

#353

Post by isbvhodnvemrwvn »

gregnr wrote: post #43

Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections: - Encourage folks to use read-only by default in our docs [1] - Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2] - Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2] We noticed that t…

> Sadly General Analysis did not follow our responsible disclosure processes [3] or respond to our messages to help work together on this.

They did put your disclosure process and messages into an llm prompt, but llm chose to ignore it.

Re: Supabase MCP can leak your entire SQL database

#356

Post by raspasov »

vidarh wrote: post #238
raspasov wrote: post #201

The MCP hype is real, but top of HN? That's like saying that if anyone can submit random queries to a Postgres database with full access, it can leak the database. That's like middle-school-level SQL trivia.

The fact that a fairly established company made a mistake like this makes it newsworthy.

I see no mistake (not associated with Supabase).

Re: Supabase MCP can leak your entire SQL database

#357

Post by tomhow »

rvz wrote: post #3

The original blog post: [0] This is yet another very serious issue involving the flawed nature of MCPs, and this one was posted over 4 times here. To mention a couple of other issues such as Heroku's MCP server getting exploited [1] which no-one cared about and then GitHub's MCP server as well and a while ago, Anthropic's MCP inspector [2] had a RCE vulnerabilty with a CVE severity of 9.4! There is no reason for an L…

We change the URL to https://www.generalanalysis.com/blog/supabase-mcp-blog from https://simonwillison.net/2025/Jul/6/supabase-mcp-lethal-tri..., thanks!

Re: Supabase MCP can leak your entire SQL database

#358

Post by frabcus »

tptacek wrote: post #281
saurik wrote: post #269

Earlier quoted context omitted.

I don't think anyone has a cohesive definition of "agent", and I wish tptacek hadn't used the term "agent" when he said "agent code", but I'll at least say that I now feel confident that I understand what tptacek is saying (even though I still don't think it will work, but we at least can now talk at each other rather than past each other ;P)... and you are probably best off just pretending neither of us ever said "a…

The thing I naturally want to say in these discussions is "human code", but that's semantically complicated by the fact that people use LLMs to write that code now. I think of "agent code" as the distinct kind of computing that is hardcoded, deterministic, non-dynamic, as opposed to the stochastic outputs of an LLM. What I want to push back on is anybody saying that the solution here is to better train an LLM, or to…

Anthropic call this "workflow" style LLM coding rather than "agentic" - as in this blog post (which pretends it is about agents for hype, but actually the most valuable part of it is about workflows).

https://www.anthropic.com/engineering/building-effective-age...

Re: Supabase MCP can leak your entire SQL database

#359

Post by friendzis »

gregnr wrote: post #43

Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections: - Encourage folks to use read-only by default in our docs [1] - Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2] - Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2] We noticed that t…

> prompt injection is generally an unsolved problem

No, with the way these LLM/GPT technologies behave, at least in their current shape and form, "prompt injection" is an unsolvable problem. A purist would even say that there is no such thing as prompt injection at all.

Re: Supabase MCP can leak your entire SQL database

#360

Post by renatovico »

TeMPOraL wrote: post #179
jacquesm wrote: post #125

Earlier quoted context omitted.

The main problem seems to me to be related to the ancient problem of escape sequences and that has never really been solved. Don't mix code (instructions) and data in a single stream. If you do sooner or later someone will find a way to make data look like code.

That "problem" remains unsolved because it's actually a fundamental aspect of reality. There is no natural separation between code and data. They are the same thing. What we call code, and what we call data, is just a question of convenience. For example, when editing or copying WMF files, it's convenient to think of them as data (mix of raster and vector graphics) - however, at least in the original implementation,…

> There is no separation of code and data on the wire - everything is a stream of bytes. There isn't one in electronics either - everything is signals going down the wires.

It has the packet header, exactly the code part that directs the traffic. In reality, everything has a "code" part and a separation for understanding. In language, we have spaces and question marks in text. This is why it’s so important to see the person when communicating, Sound alone might not be enough to fully understand the other side.

Post reply on HN