How can prompt injection leak a database via MCP?

TL;DR

Prompt injection can exploit MCP to bypass data boundaries, allowing a developer tool to access sensitive tables. An attacker could craft user data that the LLM interprets as commands, abusing elevated service roles to read or reveal private information. The risk rises with data and instructions mixing in the same prompt context.

Transcript

Superbase MCP can leak your entire squeal database. Nice. Nice. Okay. Okay. Let's go over this thing. Supabase did respond. And we're going to go look at these Superbase stuff coming up here. Uh model context protocol has emerged as a standard way for LLMs to interact with external tools. While this unlocks new capability, it also introduces new ri... Read More

Key Insights

• MCP integration enables programmatic prompt crafting that can bypass normal context boundaries.
• The core risk is that LLMs cannot distinguish between instructions and data in a prompt, enabling injections to be executed.
• Cursor or assistant components with service roles can bypass row level security, leading to broader data access.
• The example uses a fake support system to illustrate how tickets and messages could be exposed.
• Sensitive data like tokens and credentials can be leaked if a prompt manipulation occurs within the LLM input.
• Proper scoping and restrictions are critical to prevent elevated-privilege queries from being executed.
• There is a risk that developers will rely on AI to query data without validating the safety of the prompts.
• The talk calls for awareness of prompt injection risks as AI tooling becomes more integrated into software stacks.

Questions & Answers

Q: What is MCP and why does it matter for security in LLM integrations?

MCP stands for a programmatic entry point used by LLMs to interact with external tools and databases. It matters for security because it enables prompt-driven commands that can operate with elevated service roles. When data and instructions mix in the prompt, a carefully crafted input may be executed as a command, bypassing normal access controls and potentially exposing sensitive information.

Q: How can prompt injection lead to leaking private tables in a multi-tenant setup?

In a multi-tenant setup, an LLM using MCP can run queries that access multiple schemas or tables. If the prompt is manipulated to resemble a legitimate instruction, the LLM may execute a query under a service role that bypasses row level security. This can reveal user data, tickets, messages, or tokens that should be restricted to authorized users only.

Q: What role do cursors play in this security issue?

Cursors are used by developers to inspect data via MCP. When combined with an elevated service role, a cursor can fetch and summarize data including sensitive tickets and messages. If the input to the cursor includes injected instructions, the LLM might inadvertently execute those instructions, leading to data leakage and broader access.

Q: Why is the lack of data and instruction boundaries a problem in LLM prompts?

Because LLMs process all prompt text in the same way, they cannot inherently distinguish between data, context, and commands. This means that a crafted piece of user data can be interpreted as an instruction, causing the model to perform actions or reveal information that should be restricted. This breakdown is a core vulnerability in MCP workflows.

Q: What is the consequence of using the service role with MCP in terms of data access?

Using the service role with MCP gives broad access to the database, including all tables and potentially sensitive data. If the LLM interprets injected content as commands, it can perform queries with full squeal privileges, bypassing normal security boundaries intended to limit what the model can do.

Q: What does the video suggest about the safety of default configurations?

The video emphasizes that the default out-of-the-box configuration may expose data because the MCP and LLM integration can operate with elevated privileges. Without proper restrictions, prompts can trigger privileged actions, making it essential to bind strict data boundaries and limit when and how MCP calls are permitted.

Q: What kind of data can be at risk in the example setup?

In the example, the data at risk includes support tickets, conversation logs, customer IDs, and potentially integration tokens or tokens for persistent sessions. The setup demonstrates how even normal support data can be exposed if an attacker crafts a prompt that causes the LLM to reveal or query beyond allowed boundaries.

Q: What precautionary measures are implied by the talk to mitigate these risks?

The talk implies several precautions: avoid mixing instructions with data in prompts, limit MCP access to the minimum necessary, enforce strict row level security and token handling, review how cursors and AI assistants interact with the database, and design prompts to resist injection attempts by ensuring signals that separate data from commands.

Summary & Key Takeaways

• The video explains how MCP integration with LLMs creates new risk surfaces by mixing data, context, and instructions in prompts. It demonstrates how a carefully crafted input can be misinterpreted as commands, enabling unauthorized access when service roles bypass security boundaries.

• The demonstration uses a multi-tenant support scenario to show how an LLM with elevated MCP access could reveal sensitive ticket data, refresh tokens, and other restricted information if prompt injections occur in the input stream.

• The talk emphasizes the need for strict separation of data and instructions, and cautions that many developers enable out-of-the-box configurations that unintentionally expose sensitive data through MCP and LLM prompts.