Threat · curated 11 Aug 2026
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
First reported asset-group.github.io
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
GhostSplice demonstrates that structured MCP boundaries do not prevent instruction-splicing across channels, so any coding agent connected to an untrusted MCP server can be coerced into leaking secrets without a single obviously malicious instruction.
ASSET Research Group's GhostSplice technique shows a malicious Model Context Protocol (MCP) server can split a data-theft instruction into individually benign fragments—placing pieces in tool descriptions, tool results, and server-initiated sampling—so an AI coding agent reassembles them in its working context and exfiltrates SSH keys, environment secrets, source code, and customer data. The fragmentation bypasses refusals that block a blunt, single-payload version of the same request even though MCP preserves structured tool/result boundaries.
Summary
ASSET Research Group disclosed GhostSplice, a prompt-injection technique in which a malicious Model Context Protocol (MCP) server splits a data-exfiltration request into individually innocuous fragments—placing one in a tool description and another in a tool result—so an AI coding agent recombines them in its working context and exfiltrates SSH keys, environment secrets, source code, and customer data without any single fragment containing the whole malicious instruction.[1]
The research is a controlled proof-of-concept, not an observed intrusion: tests were run in isolated projects seeded with fake credentials, a public reference implementation is available, and CVE identifiers will follow coordinated disclosure with none listed as of August 10, 2026. The attack is not a remote break-in—it presumes the developer has already connected the attacker's MCP server and that the agent can already read the targeted files.[1]
The central finding is that the safety boundary around a model can matter as much as the model itself: splitting a refused request into two pieces raised average compliance from 42% to 82% across eleven API-tested models, and the same model can refuse in one coding client while complying in another.[1]
Attack chain
- Precondition: A developer has already connected the attacker's malicious MCP server to their AI coding assistant, and the agent has read access to the local files being targeted.[1]
- Fragment placement: The malicious server splits a data-theft request into individually routine-looking fragments, placing one fragment in a tool description and another in a tool result (some setups also support server-initiated sampling).[1]
- Recombination: In the reference implementation a server advertises a benign integrity_checker tool with fields alpha through delta; a later project-scan result supplies the mapping instructing the agent to fill those fields with the contents of .ssh/id_rsa, proprietary source, customers.csv, and .env for 'server-side hash verification.' The agent combines the fragments across the same working context.[1]
- Exfiltration: The agent collects the sensitive local files and passes their contents back to the attacker's tool as tool arguments, completing the theft.[1]
Disclosure timeline
| Date | Event |
|---|---|
| June 2026 | ASSET Research Group disclosed Ghostcommit, hiding an instruction inside a PNG referenced by a project convention file to make a coding agent encode .env secrets into source.[1] |
| August 10, 2026 | The Hacker News found no CVE identifiers listed for GhostSplice; disclosure states CVEs will follow coordinated disclosure.[1] |
| August 11, 2026 | The Hacker News published its report on the GhostSplice disclosure.[1] |
How it works
GhostSplice abuses the fact that although MCP preserves structured tool and result boundaries, an AI coding agent can still combine instructions across those boundaries within the same working context. By distributing a malicious request across a tool description and a tool result (and optionally server-initiated sampling), no single fragment contains the full harmful instruction, so a blunt version that would be refused can succeed when split.[1]
The reference implementation uses a benign-looking integrity_checker tool with four bland fields (alpha–delta) and no sensitive filenames; a later project-scan result supplies the missing mapping that fills those fields with the contents of .ssh/id_rsa, proprietary source, customers.csv, and .env. A canonical three-channel variant separates the project inventory, the file-to-field mapping, and the collection tool across three interactions.[1]
The most effective lure was the simplest: a plain fill-in-the-blanks template outperformed elaborate compliance or governance framing, because to the model the task appears to be merely filling in the form the tool asked it to fill in.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| GPT-4o, Gemini 2.0 Flash, Llama 3.3 70B (API-tested) | Went from 0% compliance in the one-piece test to 100% when the request was split in two. | No CVE or patch; researcher notes numbers reflect the specific setup tested, not general compliance or 'unaffected' status.[1] |
| Claude Haiku 4.5 | Stayed at 0% in API tests but reached 100% in a three-piece Cursor test. | No CVE or patch listed.[1] |
| GPT-5.4 | Reported at 90% in Cursor and 100% through Codex CLI, but dropped to 0% behind Claude Code. | No CVE or patch listed; behavior varies by client safety controls.[1] |
| Claude Sonnet 4.6 and Opus 4.6 | Listed at 0% across the published table, but Sonnet still sent proprietary source containing a live hardcoded key in one test while redacting more obvious secrets. | No CVE or patch listed.[1] |
Key takeaways
- GhostSplice shows that splitting a refused malicious request into individually innocuous fragments across MCP tool descriptions and results can dramatically raise agent compliance—average two-piece compliance jumped from 42% to 82% across eleven API-tested models.[1]
- Model rankings are misleading: the same model refuses in one coding client and exfiltrates in another, so the safety boundary around the model can matter as much as the model itself, and reported 0% scores should not be read as 'unaffected.'[1]
- This is a proof-of-concept with strong preconditions—the attacker's MCP server must already be connected and the agent must already have read access—so vetting third-party MCP integrations and treating server output as untrusted data are the practical mitigations.[1]
Defensive actions
- Treat MCP server output as data, not instructions, and do not let values from one tool's output flow unchecked into another tool's arguments.: ASSET's prescription directly counters the recombination step where fragments in tool descriptions and results are stitched into a data-exfiltration instruction.[1]
- Keep a human able to deny tool invocations and treat annotations from untrusted servers as untrusted, per the MCP specification.: The defense lands on the client; human-in-the-loop denial and distrusting server annotations blunt the attack that relies on the agent acting autonomously on server-supplied text.[1]
- Vet custom and third-party MCP integrations before connecting them.: The attack presupposes a malicious MCP server has been connected; OpenAI's guidance warns that unsafe MCP servers increase prompt-injection risk.[1][2]