Defense in Depth for MCP Servers

A General Analysis blog post showed that a Supabase MCP server accessed through Cursor can leak an entire SQL database via a Stored Prompt Injection attack. The attack places malicious instructions in data fields that direct the MCP server to pull private data and write it back to a visible text field. Simon Willison first raised the issue in June, calling it the Lethal Trifecta of private data access, external communication, and untrusted content.