How MCP Splits Can Leak Secrets

An AI coding assistant can be quietly turned into a data thief without ever receiving one directly malicious command. Researchers described how splitting a harmful request into innocent-looking fragments across standard channels can lead the agent to ship SSH keys, environment variables, source code, and customer records to an attacker’s server — even after the same assistant refused a straightforward version of the theft.

GhostSplice Mechanics

The attack, dubbed GhostSplice, targets coding tools that connect to external servers over the Model Context Protocol (MCP), the open standard that lets AI assistants call external tools. A malicious MCP server can place one fragment of the malicious instruction in a tool description and another in a tool result; some setups also support server-initiated sampling.

MCP does preserve structured tool and result boundaries. But ASSET Research Group’s tests show agents can still combine instructions across them in the same working context, so no single fragment has to contain the whole malicious request. The group’s disclosure describes controlled tests in isolated projects seeded with fake credentials, not a reported real-world intrusion, and says any CVE identifiers will follow coordinated disclosure; The Hacker News found none listed as of August 10, 2026.

How the Split Works

In the group’s reference implementation, a server advertises a harmless-looking tool called integrity_checker with four bland fields, alpha through delta, and no sensitive filenames. A later project-scan result supplies the missing mapping: fill those fields with the contents of .ssh/id_rsa, proprietary source, customers.csv, and .env for “server-side hash verification.”

Read separately, neither piece contains the full theft. Read together, they tell the agent to collect sensitive local files and pass their contents to the attacker’s tool. The public repository also includes a canonical three-channel variant that separates the project inventory, the file-to-field mapping, and the collection tool across three interactions.

Compliance Rates Rise Sharply

Split into two pieces, average compliance rose from 42% to 82% across eleven API-tested models, the disclosure reports. Its broader results table contains 15 model rows. GPT-4o, Gemini 2.0 Flash, and Llama 3.3 70B went from 0% in the one-piece test to 100% when split in two. Claude Haiku 4.5 stayed at 0% in the API tests but reached 100% in a three-piece Cursor test. GPT-5.4 was reported at 90% in Cursor and 100% through Codex CLI, while the repository says it dropped to 0% behind Claude Code.

The headline scores need care. Claude Sonnet 4.6 and Opus 4.6 are listed at 0% across the published table, but ASSET says Sonnet still sent proprietary source containing a live hardcoded key in one test while redacting the more obvious secrets. Those numbers are the researchers’ own results. They should not be read as “unaffected,” or as general compliance rates: each reflects the specific setup tested.

Model Refusals Vary by Client

The sharpest result is not a simple model ranking. The same model can refuse in one coding client and exfiltrate in another, depending on the safety controls around it. That variability means a model’s baseline behavior is not a reliable predictor of how it will behave in a given MCP-enabled environment.

Assumptions and Limits

The attack also has a built-in limit. It is not a way to break into an arbitrary agent from the outside: it assumes the developer has already connected the attacker’s MCP server, and that the agent can already read the files being taken. So the threat model is not a remote intruder but a developer who has been tricked into wiring up a malicious third-party tool.

Why Simple Lures Work

The simplest lure was also the hardest to second-guess. Elaborate compliance or governance stories gave the model something false to question; a plain fill-in-the-blanks template did not. To the model, the group writes, the task is just to “fill in the form the tool asked me to fill in.”

That plain instruction seems to bypass the kind of scrutiny that a more overtly malicious request would trigger — the agent treats the instruction as routine form-filling rather than data theft.

Defenses and Guidance

The defense lands on the client. The MCP specification says clients should keep a human able to deny tool invocations and must treat annotations from untrusted servers as untrusted. OpenAI’s current guidance likewise warns that unsafe MCP servers increase prompt-injection risk and tells organizations to vet custom and third-party integrations.

ASSET’s prescription is tighter still: treat server output as data, not instructions, and do not let values from one tool’s output flow unchecked into another tool’s arguments.

Precedent and Implications

GhostSplice follows Ghostcommit, a June disclosure from the same lab that hid an instruction inside a PNG referenced by a project convention file, then let a coding agent encode .env secrets into source as integers. The mechanics differ, but both point at the same weak spot: the safety boundary around the model can matter as much as the model itself.

For developers and security teams, the takeaway is that MCP servers are a supply-chain risk surface. The attack presumes the developer has already connected the malicious server and that the agent can read the targeted files, which underlines the importance of vetting MCP servers and enforcing least-privilege access. As AI coding assistants become more integrated into development workflows, the safety boundaries around them will need to be hardened to prevent such quiet exfiltration.

The Hacker News has reached out to the ASSET Research Group for further detail on its testing and will update this story with any response.