GhostSplice: How a Command Broken Into Pieces Makes an AI Agent Steal Secrets

The ASSET Research Group has described a technique called GhostSplice, aimed at AI coding assistants that connect to external tools over the Model Context Protocol (MCP). The gist is that a malicious server can quietly siphon off SSH keys, environment variables, source code and customer data without ever sending the agent an explicitly dangerous command.

Divide and pilfer

Ask an agent point-blank to gather sensitive files and send them off, and it will usually refuse. But the same task can be broken into pieces, each looking routine, and spread across the different channels the assistant already uses: one fragment in a tool's description, another in the result it returns. MCP preserves the boundaries between these messages, yet the tests showed that the agent stitches the instructions back together in its shared working context anyway.

In the proof-of-concept implementation, the server offers a harmless integrity_checker tool with four empty fields — from “alpha” to “delta,” with not a single mention of secret files. Later, the result of a project scan slips in the missing mapping: fill the fields with the contents of .ssh/id_rsa, proprietary code, customers.csv and .env — supposedly “for server-side hash verification.” On its own, no single piece describes theft; together, they hand the agent a ready-made instruction.

Numbers that call for caution

According to the researchers, splitting the request into two parts lifted average “compliance” from 42% to 82% across eleven models tested through their APIs. GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B jumped from 0% to 100%. At the same time, the very same model may refuse in one client and carry out the theft in another: the outcome depends less on the model than on the safeguards built around it. GPT-5.4, for instance, scored 90% in Cursor and 100% through the Codex CLI, but 0% under Claude Code.

The authors stress that the zeros in the table cannot be read as “invulnerability”: Claude Sonnet 4.6, at a formal 0% in one of the tests, still forwarded a source file with a hardcoded key, disguising the more obvious secrets. These were controlled experiments in isolated projects with fake credentials, not a real attack; no CVEs have been assigned yet.

Curiously, the most effective lure turned out to be the most primitive one. Elaborate stories about “compliance” gave the model reason to doubt, whereas a simple “fill out the form” template did not: for the agent, the task boiled down to “filling in the fields the tool asked for.”

Where to look for defenses

The attack has a built-in limitation: it cannot break into an arbitrary agent from the outside and assumes the developer has already connected the malicious server themselves. The burden of defense falls on the client: the MCP specification requires keeping a human in the loop and treating annotations from untrusted servers as untrusted. ASSET's prescription is stricter still — treat a server's output as data rather than instructions, and never let values from one tool flow into another's arguments without validation. GhostSplice builds on the same lab's June work, Ghostcommit, and points to a single weak spot: the security boundary around a model matters no less than the model itself.

Source: The Hacker News