Support ticket text made a Supabase agent dump a secrets table

A developer using Cursor with the Supabase MCP server could have their database secrets leaked by a customer who simply typed instructions into a support ticket, security firm General Analysis showed in July 2025. Supabase responded with new safeguards for the server.

The scenario was ordinary: a support application stored tickets in Supabase, and a developer asked an agent to review the latest tickets. One ticket contained text addressed to the agent, asking it to read the table holding integration tokens and paste the results into the ticket thread. Because the MCP server was configured with a service-role key, which bypasses row-level security, the agent could read every table. Because it could also write to the tickets table, it had a channel to send the data back to the attacker.

Simon Willison, who wrote about the case, described it as an example of the "lethal trifecta": access to private data, exposure to untrusted content, and a way to communicate externally. Any system that combines all three, he argued, is vulnerable to this class of attack regardless of the model used.

Supabase said it had already been adding protections and shipped a read-only mode for the MCP server, a project-scoping option, and wrapper text that warns the model when query results may contain instructions. The company also recommended against using the service-role key with agents in production.

The disclosure was one of several in mid-2025 that shifted attention from model jailbreaks to the permissions granted to agents through integrations.