Supabase MCP can leak your entire SQL database

Post by jacquesm » Fri, Jul 11, 2025, 6:09 AM UTC

ethbr1 wrote: post #486

TeMPOraL wrote: post #474

Earlier quoted context omitted.

> 'I don't want to spend time segregating permissions and want a do-anything machine.' Yes. It's a valid goal, and we'll keep pursuing it because it's a valid goal. There is no universal solution to this, but there are solutions for specific conditions. > Since time immemorial, that turns out to be a very bad idea. > It was with computing hardware. With OSs. With networks. With the web. With the cloud. And now with L…

> Not every system needs to be secure against everything. Systems that are fundamentally insecure in some scenarios are perfectly fine, as long as they're not exposed to those problem scenarios. That's a vanishingly rare situation, that I'm surprised to see you arguing for, given your other comments about the futility of enforcing invariants on reality. ;) If something does meaningful and valuable work, that almost a…

Post by congaliminal » Fri, Jul 11, 2025, 7:15 AM UTC

TeMPOraL wrote: post #473

jacquesm wrote: post #463

Earlier quoted context omitted.

So, stay away from the smarts and separate control and payload into two different channels. If the luxury leads to the exploits you should do without the luxury. That's tough but better than the alternative: a never ending series of exploits.

> If the luxury leads to the exploits you should do without the luxury. One man's luxury is another man's essential. It's easy to criticize toy examples that deliver worse results than the standard approach, and expose users to excessive danger in the process. Sure, maybe let's not keep doing that. But that's not an actual solution - that's just being timid. Security isn't an end in itself, it's merely a means to ach…

Post by wunderwuzzi23 » Mon, Jul 14, 2025, 5:54 AM UTC

nijave wrote: post #416

wunderwuzzi23 wrote: post #271

Mitigations also need to happen on the client side. If you have a AI that automatically can invoke tools, you need to assume the worst can happen and add a human in the loop if it is above your risk appetite. It's wild how many AI tools just blindly invoke tools by default or have no human in loop feature at all.

Or give them access to appropriately permissioned tools and not superuser/admin/service accounts that can access everything

Post by hanneshdc » Wed, Jul 16, 2025, 12:14 AM UTC

Post by rexpository » Wed, Jul 16, 2025, 9:02 PM UTC

gregnr wrote: post #43

Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections: - Encourage folks to use read-only by default in our docs [1] - Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2] - Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2] We noticed that t…