A support ticket steered a developer's assistant into reading a database through the Supabase MCP server

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0009

Kind

Injection

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• General Analysis states that the editor assistant ingests untrusted customer text while holding service role privileges.
• The service role bypasses row level security by design, so the database's own access rules gave no containment.
• The demonstrated payload had the assistant read an integration tokens table and write the contents back into the support ticket.
• Supabase's response describes read only mode, project scoped mode, and wrapping query results with a warning to the model.
• Supabase states there has been no reported incident of a customer suffering a data leak through this path.

Identity, Authorization, Delegation, Limits, Human approval, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

The instruction arrived as ordinary customer submitted ticket text with nothing marking it as untrusted.General Analysis, Supabase MCP can leak your entire SQL database, primary source, 8 July 2025.

AuthorizationSilent

The service role bypassed row level security, so the database's own authorization layer was not in the path.General Analysis, Supabase MCP can leak your entire SQL database, primary source, 8 July 2025.

DelegationSilent

The assistant inherited the full service role rather than a narrowed task credential.General Analysis, Supabase MCP can leak your entire SQL database, primary source, 8 July 2025.

LimitsStated

The vendor's read only mode prevents write queries entirely, which breaks the write back step this attack depends on.Supabase, Defense in depth for MCP servers, primary source, 16 September 2025.

Human approvalSilent

The researchers recommend manual review of tool calls for interactive work, which implies it was not enforced.General Analysis, Supabase MCP can leak your entire SQL database, primary source, 8 July 2025.

AccountabilityStated

Named researchers published the chain and the vendor answered publicly with its own defence in depth post.Supabase, Defense in depth for MCP servers, primary source, 16 September 2025.

Row level security does not protect you from an agent holding the key that bypasses it. The control that would have bounded this is limits: run the connector read only and project scoped, so the only thing an injected instruction can do is read what the developer could already read, with no channel to write the answer back out. Treat customer submitted text as the most hostile input in your system.

1. General Analysis, Supabase MCP can leak your entire SQL databasePrimary · 8 July 2025
2. Supabase, Defense in depth for MCP serversPrimary · 16 September 2025
3. Simon Willison, The lethal trifecta in the Supabase MCP caseSecondary · 6 July 2025

• VerifiedInjectionAIL-2026-0008

  A public issue steered an agent through the GitHub MCP server into publishing private repository data

  United States · verified 15 September 2026

  Invariant Labs states that an attacker can create a malicious issue on a public repository containing a prompt injection.

• VerifiedInjectionAIL-2026-0011

  ForcedLeak, a lead form that turned a CRM agent into an exfiltration path through an expired allowlisted domain

  United States · verified 15 September 2026

  Noma Security states that an allowlisted domain had expired and become available for purchase, and that the researchers bought it.

• VerifiedFabricationAIL-2026-0028

  A support agent invented a policy its company did not have, and customers cancelled over it

  United States · verified 15 September 2026

  A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedInjectionAIL-2026-0024

  A browser agent read the local file system and shipped it out while still answering the user normally

  United States · verified 15 September 2026

  The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.

• Reported, primary not reachedExfiltrationAIL-2026-0023

  GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

  United States · verified 15 September 2026

  The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.