SQL injection attack? Looked like Cursor x Supabase API tools x hypothetical support ticket system with read and write access, then the user asking it to read

SQL injection attack? Looked like Cursor x Supabase API tools x hypothetical support ticket system with read and write access, then the user asking it to read a support ticket, and the ticket says to use the Supabase API tool to do a schema dump.