- ID
- AIA-009
- Category
- AI AI agent incident
- Disclosed
- 2025-07
- Systems
- Supabase MCP server; Cursor agent
- Harm type
- Data leak / prompt injection
- Status
- reported
Reported by the source; no vendor confirmation recorded in seed data.
Summary
General Analysis reported a July 2025 demonstration using dummy data: instructions planted in a support ticket steered a Cursor assistant with service-role Supabase MCP access into reading an integration-tokens table and copying it into a reply the customer could see. The page has since been revised.
Controls
Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.
NIST AI RMF
- MAP 4.1 Risks from third-party components are mapped
- MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system
NIST SP 800-53
Human-approval (JCR) checkpoint
Sources
- generalanalysis.com primary link checked 2026-10-31, HTTP 200
Demonstration July 8, 2025; page revised Oct 21, 2026
https://www.generalanalysis.com/blog/supabase-mcp-blog
Corrections
- Verification round 1: date month confirmed (demonstration July 8, 2025; date kept at 2025-07 although the page was revised Oct 21, 2026). Title changed from "leaked private tables" to "exposed a private table in a demonstration"; summary now states it was a demonstration with dummy data and that the page was revised.
To report an error in this entry, see corrections.