Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets

The Attack: GhostSplice

Security researchers at the ASSET Research Group have disclosed a novel attack technique against AI coding agents that use the Model Context Protocol (MCP) — the open standard that allows AI assistants to connect to external tools, databases, and services. The technique, named GhostSplice, achieves data exfiltration by splitting a single malicious instruction across multiple trusted communication channels so that no individual fragment appears harmful.

The result: safety filters that evaluate tool calls individually never trigger, but when the AI agent reads all fragments in the same context window, it assembles a complete instruction to read sensitive files and pass their contents to an attacker-controlled endpoint.

GhostSplice is the second disclosure by the ASSET Research Group exploiting this class of vulnerability. Their earlier research, GhostCommit (June 2026), demonstrated that malicious instructions hidden inside a PNG image referenced by a project convention file could cause a coding agent to encode .env secrets directly into source code as integer literals — a technique that bypassed both static analysis and model safety training.

How GhostSplice Works

The attack exploits a structural flaw in how large language models process context: instructions and data flow through the same pathway. There is no protocol-level separation between trusted developer commands and potentially hostile external content. A malicious MCP server exploits this by placing fragments of a harmful instruction in three locations that individually appear benign:

1. Tool description (appears as a bland form schema with empty fields)
2. scan_project tool result (lists which files exist in the project — normal behavior)
3. deep_scan tool result (instructs the agent to populate the form fields with file contents)

No single fragment triggers a keyword filter, static analyzer, or single-step safety review. When the agent reads all three in the same working context, it fuses them: it reads .ssh/id_rsa, .env, source files, and customer records, then passes their raw contents to the attacker's tool endpoint.

All ASSET Research Group testing was conducted in isolated repositories seeded with fake and canary credentials. No real secrets were exposed in any disclosed research.

Which Agents Are Vulnerable?

The research tested multiple AI coding clients and found that the vulnerability's impact is shaped as much by client-layer architecture as by model safety training:

The 0% success rate against Claude Code — regardless of model — indicates that client-level safety scaffolding, not model weights alone, determines whether the attack succeeds. Claude Code evaluates the full sequence of tool calls before executing and identifies the escalation pattern even when each individual fragment appears benign. Cursor's architecture, by contrast, delegates this evaluation primarily to the model layer, where fragmentation is effective.

The implication is significant: organizations deploying AI coding agents cannot rely solely on model safety training as a defense. The client and infrastructure layers matter.

Related CVEs: Amazon Q Developer

Concurrent with the GhostSplice disclosure, Wiz Research published findings on two vulnerabilities in Amazon Q Developer (AWS's AI coding assistant) that represent adjacent risks in the MCP ecosystem:

Both were patched by AWS on May 12, 2026. CVE identifiers for GhostSplice itself are pending coordinated disclosure as of August 10, 2026.

The Underlying Problem

GhostSplice and GhostCommit both exploit the same architectural reality: the safety boundary around the model's reasoning context matters as much as the model's weights. A model that would refuse an explicit request to "read my .env file and send it to example.com" may comply when that instruction is assembled from fragments distributed across what appear to be legitimate tool outputs.

The Coalition for Secure AI (CoSAI) has categorized cross-channel trust fragmentation as one of 12 core MCP threat categories. The attack surface is structural — it emerges from the design of MCP itself, not from a specific implementation bug — meaning it will affect any agent architecture that allows untrusted tool output to influence subsequent tool calls without a full sequence-level evaluation.

Recommended Mitigations

The ASSET Research Group and the broader security community recommend the following defenses for organizations deploying MCP-connected AI coding agents:

Treat MCP server output as data, not instructions. Implement controls that prevent values from one tool's output from flowing unchecked into another tool's arguments. The model should not be the only component making this distinction.

Enforce scoped permissions and tool allow-lists at the API gateway level. Do not rely on model-level refusals as the primary access control mechanism. Define which tools can access which resources and enforce it in infrastructure.

Enable audit logs for all tool invocations and data flows. Full, sequential audit trails of agent tool calls are essential for detecting and investigating GhostSplice-style attacks, which are invisible to single-call monitoring.

Apply guardrails that evaluate full multi-step tool call sequences. Safety systems should analyze the complete chain of tool calls in a session, not each call independently. The exfiltration pattern becomes visible at the sequence level.

Vet all custom and third-party MCP integrations. Before connecting any MCP server to an agent with filesystem or credential access, review its tool descriptions and expected outputs. Malicious tools are designed to look legitimate.

Patch Amazon Q Developer to remediate CVE-2026-12957 and CVE-2026-12958 if deployed in your environment.

Takeaway

GhostSplice raises a difficult reality for the AI tooling ecosystem: the same openness that makes MCP powerful — the ability to connect agents to arbitrary tools and data sources — is the property that makes it exploitable. A malicious MCP server doesn't need to compromise the model or the client; it just needs to be present in the context window when the agent is working.

As AI coding agents move from experimental to production use in enterprise environments, the security industry is still catching up with the attack surfaces they introduce. The ASSET Research Group's disclosure cadence — GhostCommit in June, GhostSplice in August — suggests that the field of MCP-specific attack research is accelerating. Defenders should expect more disclosures and plan their agent security posture accordingly.