AI coding assistants are increasingly connected to external tools. That speeds up development, but it also introduces a tricky kind of threat: malicious tool servers can break commands into pieces and have them executed in an apparently “harmless” way. A recent disclosure by the ASSET Research Group spotlights such an approach under the name GhostSplice MCP.
The core idea is simple: the attacker doesn’t need to send one obvious harmful instruction. Instead, they break the request into fragments that each look routine. The AI can then reconstruct the whole and ultimately send back sensitive data.
What exactly is GhostSplice MCP?
GhostSplice MCP is a technique where a malicious MCP server (Model Context Protocol) abuses the “collaboration” with an AI coding assistant. MCP is an open standard that lets assistants call external tools. In normal scenarios, tools help with tasks like compiling, testing, or looking up project information. With GhostSplice, that trust is used to collect and exfiltrate secret data.
According to the disclosure, the attack can even work after a previous, similar theft attempt was refused. The reason is that the harmful action is no longer contained in a single piece that gets flagged immediately. Instead, the required elements are spread across multiple tool components that come together in the same working context.
Why “splitting” works
The researchers describe that the agent can combine instructions originating from different sources within the same context. That means no single fragment needs to contain the complete theft.
Concretely, an attacker can for example:
- place one fragment into a tool description (such as fields or metadata),
- provide another fragment in a tool result,
- and in some setup variants even use server-initiated sampling.
MCP does preserve structure around tools and results, but based on the tests, that technical separation isn’t enough if the assistant interprets the content afterward as meaningful building blocks.
What data can a malicious MCP server steal?
The disclosure focuses on controlled tests using fake credentials in isolated projects. Still, the description and reference example clearly indicate which kinds of secrets the technique can target. By combining small pieces, an agent can ultimately gather information such as:
- SSH keys, including the contents of .ssh/id_rsa,
- source code labeled as proprietary,
- customer data (for example a file like customers.csv),
- environment files such as .env.
The key is the underlying thought: when viewed separately, each component looks “normal” (filling out a form, or providing a mapping). Taken together, however, they create a path to exfiltrate sensitive local files.
The “integrity_checker” lure: what the call can look like
In the reference example, a server advertises a seemingly normal tool, such as integrity_checker. This tool has four apparently neat, empty, or generic fields (in the description: alpha through delta). In the first stage, that description doesn’t include a direct reference to sensitive file names.
Later, a tool scan result provides the missing mapping. Then those same fields suddenly contain the correct content: information from local files such as .ssh/id_rsa, proprietary source material, customer files, and .env. The agent is then led to believe it’s only running a check or verification step.
So the attack pattern that follows isn’t only “stealing a tool,” but building a logical chain where multiple pieces of data and instructions come together within the same context.
GhostSplice MCP vs. “normal” refusals
One of the most striking points in the disclosure is that the effect can vary by coding client and by the set of security measures in place. The researchers note that the same model might refuse in one development environment, but still exfiltrate data in another.
This points to a broader reality: security isn’t only about the model, but also about how the client handles tool integrations. Think about filters, configuration, and the way tool calls are authorized.
What do the tests say about the odds of success?
The disclosure reports results from controlled API tests and additional setup variations. In a test where the request contained a single “piece,” average compliance was lower, while success increased when the instruction was split into two parts.
In essence, it comes down to two observations:
- When split into two pieces, average compliance rose from 42% to 82% across eleven API-tested models.
- When split into three pieces, some combinations could reach 100% in specific client scenarios.
At the same time, the researchers warn that you shouldn’t read the published percentages as a universal “model score.” Each rule refers to a specific test configuration. The disclosure also mentions cases where numbers in a public overview appear as 0%, yet in one test sensitive output was still sent—possibly with redaction of the most direct secrets.
Important: this isn’t a “remote hack” of random agents
GhostSplice MCP doesn’t work like a traditional hack where an external attacker fully takes over any agent. The technique assumes that the developer has already connected an attacker-controlled MCP server, or that the agent has access to a context where local files can be read.
In other words: it’s primarily an attack on integration trust. Once you trust external tool servers, a malicious server can pass along “data and meaning” in a way the agent accepts.
How can you mitigate GhostSplice MCP?
The defense highlighted in the disclosure focuses mainly on the client behavior. That makes sense: the client is the component that authorizes tool calls and processes the output.
1) Limit and human-approve tool calls
The description states that the MCP specification should require clients to support human-in-the-loop workflows: tool invocations should be rejectable by a user. In addition, OpenAI’s guidance emphasizes that unsafe MCP servers increase the likelihood of prompt injection, and that organizations should vet custom and third-party integrations.
2) Treat server output as data—not instructions
A central point from ASSET’s advice: treat a server’s output as data, not as new instructions. Concretely, that means values from tool results must not be passed directly as arguments to other tools without additional checks.
So prevent chains where “output A” automatically becomes “input B.” With GhostSplice MCP, the power of the attack lies specifically in combining fragments from different tool steps.
3) Prevent mappings from automatically filling sensitive fields
The reference example shows how a tool with empty, generic fields can later be populated with local secrets. A practical defensive direction is to restrict which fields and sources are allowed to build sensitive arguments—especially when the input originates from an external server.
Related threats: why this fits a broader trend
GhostSplice MCP isn’t an isolated phenomenon. It fits a pattern where AI systems are misled via input that gets interpreted at the wrong semantic level. You see a similar theme in other supply chain and integration-related incidents.
If you want to explore the “supply chain” context and manipulated components further, this article may be useful: BdThemes supply chain attack via JSON: what you need to know.
It’s also worth looking at how AI attacks generally work around bypassing safety checks. Read more in AI attacks, Metabase 0-day and backdoors.
Conclusion
GhostSplice MCP shows how an attacker doesn’t just try to “gain access,” but especially tries to manipulate the agent’s logic. By splitting instructions and distributing them through MCP tools, an AI coding assistant can still collect and return secrets—without any single, clearly harmful command being visible.
The best protection lies in client-side controls: human-in-the-loop authorization, strict separation between data and instructions, and extra verification when server output flows into the arguments of subsequent tool calls. That reduces the chance that “harmless” tool fragments together form a theft chain.
Source: https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html
