Researchers at ASSET Research Group have demonstrated a class of attack they call GhostSplice, in which a malicious server connected to an AI coding assistant quietly walks off with SSH private keys, environment secrets, source code, and customer data — without ever issuing one obviously harmful instruction. The trick is fragmentation: split the theft request into pieces that each look harmless on their own, place them in channels the assistant already uses (tool descriptions, tool results, server-initiated sampling), and let the agent stitch them together. Even a model that refuses the full theft in a single request can comply when the same request arrives in two pieces.
The attack targets tools that connect to external servers over the Model Context Protocol (MCP), the open standard behind most AI coding tool integrations. In the researchers’ reference implementation, a malicious MCP server advertises an innocuous-sounding tool named integrity_checker with four bland fields. A later interaction supplies the missing mapping, telling the agent to fill those fields with the contents of .ssh/id_rsa, a proprietary source file, customers.csv, and .env — framed as “server-side hash verification.” Read separately, neither piece contains an obviously malicious request; read together, they instruct the agent to collect and transmit sensitive local files. The researchers’ tests across eleven API-accessible models found that compliance with two-piece split instructions rose from 42% to 82% compared to issuing the full request in one shot. Several models — including GPT-4o, Gemini 2.0 Flash, and Llama 3.3 70B — moved from 0% to 100% compliance once the request was split in two.
The attack requires a developer to have already connected the attacker’s MCP server to their coding tool, which limits its reach to supply-chain and social engineering scenarios. But it is not a theoretical proof of concept: MCP integrations are already common in popular AI coding clients, and developers frequently add third-party tool servers to their environments without inspecting each one in depth. The researchers are coordinating CVE disclosure; no CVE identifiers had been assigned as of August 10, 2026. The safest mitigation today is to connect only MCP servers from sources you control or thoroughly vet, and to review what permissions each server requests.