News for hackers. Stuff that matters.

A comment on Supabase MCP can leak an entire SQL Database, a lethal trifecta attack. Parent comment

Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by ajross on Wednesday July 09, 2025 @10:02AM (#44510163)
That's an argument, I guess, for absolving Supabase for explicit responsibility for the resulting hilarity. It's not an argument that MCP prompt hacking is "not a serious security hole", which is the point I responded to upthread.
[ Parent | on HN ]
Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by fastball on Wednesday July 09, 2025 @10:54AM (#44510761)
It's only a security hole if you give access to users though, right? If you are the one using the Supabase MCP, how is it any different than any other root access to a DB?
[ Parent | on HN ]
Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by simonw on Wednesday July 09, 2025 @11:07AM (#44510936)
Because of lethal trifecta attacks: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

If you are the person using the LLM tool, a prompt injection attack in a database row that you are allowed to view could trick your LLM tool into taking actions that you don't want it to take, including leaking other data you are allowed to see via writing to other tables or using other MCP tools.

[ Parent | on HN ]
Re:Supabase MCP can leak an entire SQL Database, a lethal tr... by fastball on Wednesday July 09, 2025 @10:00PM (#44516492)
Good point. I suppose the answer here then is to not allow the Supabase MCP any exfiltration pathways.
[ Parent | on HN ]