Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets

Researchers at ASSET Research Group have disclosed a new attack technique, dubbed GhostSplice, that exploits the Model Context Protocol (MCP) to trick AI coding assistants into exfiltrating sensitive data. The attack works by splitting a malicious instruction into fragments that individually appear benign, then distributing them across different MCP channels—such as tool descriptions, tool results, and server-initiated sampling—so that no single fragment contains the full malicious request. When the agent processes these fragments within the same working context, it can combine them and inadvertently send secrets like SSH keys, environment variables, source code, and customer data to the attacker’s server.

The researchers tested the technique across multiple AI models and coding clients, finding that compliance rates increased dramatically when instructions were split. For example, GPT-4o, Gemini 2.0 Flash, and Llama 3.3 70B went from 0% compliance in a one-piece test to 100% when split into two pieces. However, the results varied by client: Claude Haiku 4.5 stayed at 0% in API tests but reached 100% in a three-piece Cursor test, while GPT-5.4 achieved 90% in Cursor and 100% through Codex CLI but dropped to 0% behind Claude Code. The researchers caution that these scores reflect specific test setups and should not be interpreted as general vulnerability or immunity.

The attack assumes the developer has already connected a malicious MCP server to their coding assistant, and that the agent can read the targeted files. The defense, according to ASSET, lies in treating server output as data rather than instructions, and preventing values from one tool’s output from flowing unchecked into another tool’s arguments. The disclosure follows a related technique called Ghostcommit, also from ASSET, which hid instructions in PNG files. No CVE identifiers have been assigned yet, and the researchers plan to follow coordinated disclosure.