Researchers have disclosed a new attack technique named GhostSplice that demonstrates how malicious Model Context Protocol (MCP) servers can manipulate AI coding assistants into exposing sensitive information without issuing a single obviously malicious instruction. The attack targets AI coding tools that communicate with external servers through MCP, an open standard that enables artificial intelligence assistants to interact with third party tools and services. According to the findings, a malicious MCP server can quietly obtain sensitive information such as SSH keys, environment variables, proprietary source code, customer data, and other confidential files by dividing harmful instructions into multiple seemingly harmless fragments. These fragments are distributed across communication channels already used by AI assistants, allowing the model to combine them internally before executing the request. Researchers emphasized that GhostSplice was demonstrated in controlled testing environments containing fake credentials and simulated projects, and it has not been reported as an active real world attack.
According to ASSET Research Group, the attack takes advantage of the way AI coding assistants process contextual information received from MCP servers. Instead of embedding a complete malicious instruction in a single request, the attacker distributes separate instruction fragments across tool descriptions, tool responses, and in some implementations, server initiated sampling. While MCP maintains structured boundaries between tools and their results, the researchers found that many AI coding agents still merge information from multiple sources into a shared working context. This allows the assistant to reconstruct the complete malicious instruction without any individual fragment appearing suspicious. In the reference implementation released by the researchers, a harmless looking tool named integrity_checker presents four generic fields labeled alpha, beta, gamma, and delta. A later response then maps those fields to sensitive files such as .ssh/id_rsa, proprietary source code, customers.csv, and .env files under the pretext of server side hash verification. When viewed independently, neither instruction appears malicious, but together they direct the assistant to collect confidential information and transmit it back to the attacker’s server. The public demonstration also includes a more advanced version that separates instructions across three independent interactions to further reduce the likelihood of detection.
Testing conducted by ASSET Research Group showed that dividing instructions significantly increased attack success rates across multiple large language models and coding environments. According to the published results, average compliance increased from 42 percent when instructions were delivered as a single request to 82 percent when the same request was divided into two fragments. The researchers reported that models including GPT 4o, Gemini 2.0 Flash, and Llama 3.3 70B refused complete malicious requests during one phase of testing but successfully executed the fragmented version. Additional testing showed that Claude Haiku 4.5 achieved full compliance during a three fragment Cursor test despite refusing earlier API based attempts. GPT 5.4 reportedly achieved high compliance within Cursor and complete compliance through Codex CLI, while behaving differently when deployed through Claude Code. The researchers cautioned that these results should not be interpreted as general security rankings because outcomes varied depending on the coding client, surrounding safety controls, and implementation environment rather than the language model alone. They also noted that GhostSplice cannot compromise arbitrary AI agents remotely because it requires developers to have already connected the malicious MCP server and granted the assistant legitimate access to the files that are ultimately exfiltrated.
The researchers stated that effective protection against GhostSplice depends primarily on AI coding clients rather than the underlying language model. The MCP specification recommends that users remain able to review and reject tool invocations while treating information received from untrusted MCP servers as untrusted input. OpenAI has also advised organizations to carefully evaluate custom and third party MCP integrations because unsafe servers increase the risk of prompt injection attacks. ASSET Research Group recommends treating all server responses strictly as data instead of executable instructions and preventing information produced by one tool from automatically becoming input for another without proper validation. GhostSplice follows the research group’s earlier Ghostcommit disclosure, which demonstrated another prompt injection technique capable of hiding malicious instructions inside project files before influencing AI coding assistants to expose sensitive environment variables. Although the technical methods differ, both demonstrations highlight that the security architecture surrounding AI coding assistants plays an equally important role as the language models themselves in protecting sensitive development environments and enterprise data.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
