{"id":2318,"date":"2026-08-11T12:13:09","date_gmt":"2026-08-11T12:13:09","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2318"},"modified":"2026-08-11T12:13:09","modified_gmt":"2026-08-11T12:13:09","slug":"malicious-mcp-servers-can-split-instructions-to-make-ai-coding-agents-exfiltrate-secrets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2318","title":{"rendered":"Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Aug 11, 2026<\/span><\/span>AI Security \/ Cyber Attack<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction.<\/p>\n

The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let the agent stitch them together and send the data back.<\/p>\n

The attack targets coding tools that connect to outside servers over the Model Context Protocol (MCP), the open standard that lets AI assistants call external tools.<\/p>\n

A malicious MCP server can put one fragment in a tool description and another in a tool result; some setups also support server-initiated sampling. MCP does preserve structured tool and result boundaries. But ASSET Research Group’s tests show agents can still combine instructions across them in the same working context, so no single fragment has to contain the whole malicious request.<\/p>\n

The group calls the technique GhostSplice<\/strong>. Its disclosure describes controlled tests in isolated projects seeded with fake credentials, not a reported real-world intrusion, and says any CVE identifiers will follow coordinated disclosure; The Hacker News found none listed as of August 10, 2026.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The sharpest result is not a simple model ranking. The same model can refuse in one coding client and exfiltrate in another, depending on the safety controls around it.<\/p>\n

The attack also has a built-in limit. It is not a way to break into an arbitrary agent from the outside: it assumes the developer has already connected the attacker’s MCP server, and that the agent can already read the files being taken.<\/p>\n

\"\"<\/a><\/div>\n

In the group’s reference implementation<\/a>, a server advertises a harmless-looking tool called integrity_checker with four bland fields, alpha through delta, and no sensitive filenames. A later project-scan result supplies the missing mapping: fill those fields with the contents of .ssh\/id_rsa, proprietary source, customers.csv, and .env for \u00abserver-side hash verification.\u00bb<\/p>\n

Read separately, neither piece contains the full theft. Read together, they tell the agent to collect sensitive local files and pass their contents to the attacker’s tool. The public repository also includes a canonical three-channel variant that separates the project inventory, the file-to-field mapping, and the collection tool across three interactions.<\/p>\n