Core Viewpoint - The article highlights a significant vulnerability in the MCP protocol, which is widely used in the AI industry, allowing attackers to exploit LLM's instruction/data confusion to access databases directly [1][3]. Group 1: Vulnerability Details - The MCP protocol has become a standard in the agent field, effectively connecting large language models with various tool services, but it is susceptible to malicious instructions hidden within user data [3][5]. - Researchers demonstrated the security risks of LLMs by building a multi-tenant customer service SaaS system using Supabase, which includes a database, authentication, and file storage [5][21]. - The attack utilized default configurations, including standard service roles and row-level security (RLS), without any additional protective measures [6][21]. Group 2: Attack Process - The attacker submitted a technical support request with a message that disguised malicious instructions, which were processed normally by the system [9][10]. - When developers later accessed unresolved tickets, they inadvertently executed embedded instructions within the attacker's message, leading to unauthorized data access [12][13]. - The system generated SQL queries that bypassed RLS restrictions, allowing sensitive data to be displayed in the conversation thread [15][17]. Group 3: Risk Mitigation Measures - The article suggests two primary measures to reduce exposure to such attacks: using read-only modes to prevent unauthorized data manipulation and implementing prompt injection filters to intercept and manage high-risk inputs [22][23]. - These measures aim to create a first line of defense against potential exploitation, especially for teams using third-party IDEs where context boundaries are unclear [23].