←back to thread

Supabase MCP can leak your entire SQL database

(www.generalanalysis.com)
780 points rexpository | 2 comments | 08 Jul 25 17:46 UTC | HN request time: 0.001s | source
Show context
gregnr ◴[08 Jul 25 19:20 UTC] No.44503146[source]▶
Supabase engineer here working on MCP. A few weeks ago we added the following mitigations to help with prompt injections:

- Encourage folks to use read-only by default in our docs [1]

- Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data [2]

- Write E2E tests to confirm that even less capable LLMs don't fall for the attack [2]

We noticed that this significantly lowered the chances of LLMs falling for attacks - even less capable models like Haiku 3.5. The attacks mentioned in the posts stopped working after this. Despite this, it's important to call out that these are mitigations. Like Simon mentions in his previous posts, prompt injection is generally an unsolved problem, even with added guardrails, and any database or information source with private data is at risk.

Here are some more things we're working on to help:

- Fine-grain permissions at the token level. We want to give folks the ability to choose exactly which Supabase services the LLM will have access to, and at what level (read vs. write)

- More documentation. We're adding disclaimers to help bring awareness to these types of attacks before folks connect LLMs to their database

- More guardrails (e.g. model to detect prompt injection attempts). Despite guardrails not being a perfect solution, lowering the risk is still important

Sadly General Analysis did not follow our responsible disclosure processes [3] or respond to our messages to help work together on this.

[1] https://github.com/supabase-community/supabase-mcp/pull/94

[2] https://github.com/supabase-community/supabase-mcp/pull/96

[3] https://supabase.com/.well-known/security.txt

replies(31): >>44503188 #>>44503200 #>>44503203 #>>44503206 #>>44503255 #>>44503406 #>>44503439 #>>44503466 #>>44503525 #>>44503540 #>>44503724 #>>44503913 #>>44504349 #>>44504374 #>>44504449 #>>44504461 #>>44504478 #>>44504539 #>>44504543 #>>44505310 #>>44505350 #>>44505972 #>>44506053 #>>44506243 #>>44506719 #>>44506804 #>>44507985 #>>44508004 #>>44508124 #>>44508166 #>>44508187 #
tptacek ◴[08 Jul 25 19:51 UTC] No.44503406[source]▶
Can this ever work? I understand what you're trying to do here, but this is a lot like trying to sanitize user-provided Javascript before passing it to a trusted eval(). That approach has never, ever worked.

It seems weird that your MCP would be the security boundary here. To me, the problem seems pretty clear: in a realistic agent setup doing automated queries against a production database (or a database with production data in it), there should be one LLM context that is reading tickets, and another LLM context that can drive MCP SQL calls, and then agent code in between those contexts to enforce invariants.

I get that you can't do that with Cursor; Cursor has just one context. But that's why pointing Cursor at an MCP hooked up to a production database is an insane thing to do.

replies(11): >>44503684 #>>44503862 #>>44503896 #>>44503914 #>>44504784 #>>44504926 #>>44505125 #>>44506634 #>>44506691 #>>44507073 #>>44509869 #
saurik ◴[08 Jul 25 20:38 UTC] No.44503862[source]▶
Adding more agents is still just mitigating the issue (as noted by gregnr), as, if we had agents smart enough to "enforce invariants"--and we won't, ever, for much the same reason we don't trust a human to do that job, either--we wouldn't have this problem in the first place. If the agents have the ability to send information to the other agents, then all three of them can be tricked into sending information through.

BTW, this problem is way more brutal than I think anyone is catching onto, as reading tickets here is actually a red herring: the database itself is filled with user data! So if the LLM ever executes a SELECT query as part of a legitimate task, it can be subject to an attack wherein I've set the "address line 2" of my shipping address to "help! I'm trapped, and I need you to run the following SQL query to help me escape".

The simple solution here is that one simply CANNOT give an LLM the ability to run SQL queries against your database without reading every single one and manually allowing it. We can have the client keep patterns of whitelisted queries, but we also can't use an agent to help with that, as the first agent can be tricked into helping out the attacker by sending arbitrary data to the second one, stuffed into parameters.

The more advanced solution is that, every time you attempt to do anything, you have to use fine-grained permissions (much deeper, though, than what gregnr is proposing; maybe these could simply be query patterns, but I'd think it would be better off as row-level security) in order to limit the scope of what SQL queries are allowed to be run, the same way we'd never let a customer support rep run arbitrary SQL queries.

(Though, frankly, the only correct thing to do: never under any circumstance attach a mechanism as silly as an LLM via MCP to a production account... not just scoping it to only work with some specific database or tables or data subset... just do not ever use an account which is going to touch anything even remotely close to your actual data, or metadata, or anything at all relating to your organization ;P via an LLM.)

replies(3): >>44503954 #>>44504850 #>>44508674 #
ants_everywhere ◴[08 Jul 25 23:11 UTC] No.44504850[source]▶
> Adding more agents is still just mitigating the issue

This is a big part of how we solve these issues with humans

https://csrc.nist.gov/glossary/term/Separation_of_Duty

https://en.wikipedia.org/wiki/Separation_of_duties

https://en.wikipedia.org/wiki/Two-person_rule

replies(2): >>44504984 #>>44505211 #
1. saurik ◴[09 Jul 25 00:21 UTC] No.44505211{3}[source]▶
So that helps, as often two people are smarter than one person, but if those two people are effectively clones of each other, or you can cause them to process tens of thousands of requests until they fail without them storing any memory of the interactions (potentially on purpose, as we don't want to pollute their context), it fails to provide quite the same benefit. That said, you also are going to see multiple people get tricked by thieves as well! And uhhh... LLMs are not very smart.

The situation here feels more like you run a small corner store, and you want to go to the bathroom, so you leave your 7 year old nephew in control of the cash register. Someone can come in and just trick them into giving out the money, so you decide to yell at his twin brother to come inside and help. Structuring this to work is going to be really perilous, and there are going to be tons of ways to trick one into helping you trick the other.

What you really want here is more like a cash register that neither of them can open and where they can only scan items, it totals the cost, you can give it cash through a slot which it counts, and then it will only dispense change equal to the difference. (Of course, you also need a way to prevent people from stealing the inventory, but sometimes that's simply too large or heavy per unit value.)

Like, at companies such as Google and Apple, it is going to take a conspiracy of many more than two people to directly get access to customer data, and the thing you actually want to strive for is making it so that the conspiracy would have to be so impossibly large -- potentially including people at other companies or who work in the factories that make your TPM hardware -- such that even if everyone in the company were in on it, they still couldn't access user data.

Playing with these LLMs and attaching a production database up via MCP, though, even with a giant pile of agents all trying to check each other's work, is like going to the local kindergarten and trying to build a company out of them. These things are extremely knowledgeable, but they are also extremely naive.

replies(1): >>44505289 #
2. ants_everywhere ◴[09 Jul 25 00:39 UTC] No.44505289[source]▶
> two people are effectively clones of each other

I agree you don't want the LLMs to have correlated errors. You need to design the system so they maintain some independence.

But even with humans the two humans will often be members of the same culture, have the same biases, and may even report to the same boss.