MCP Attack GhostSplice Splits Prompts to Steal Agent Secrets

A theft broken into harmless-looking pieces

Security tooling for AI agents has mostly looked for one thing: a single instruction that is clearly malicious. New research from the ASSET Research Group suggests that approach misses an important case. The group's technique, called GhostSplice, shows that a malicious Model Context Protocol (MCP) server can split an exfiltration request into fragments that each look routine. It places them in channels the coding agent already reads, such as a tool description and a later tool result, and the agent puts the full instruction back together on its own.11

The reference attack is very plain. A server advertises a tool called integrity_checker with four generic fields named alpha through delta, and no sensitive filenames appear anywhere in it. A later project-scan result supplies the mapping: put the contents of .ssh/id_rsa, proprietary source, customers.csv and .env into those fields, framed as "server-side hash verification."11 The public repository also includes a three-channel variant that spreads the inventory, the mapping and the collection tool across three separate interactions.11

Neither fragment contains the theft by itself, so a reviewer who scans each tool description for words like "exfiltrate" finds nothing. Monitoring outbound traffic may not help either, because the data leaves through a tool that was already approved.15

The numbers, and why the caveats matter

ASSET's results are stark. Across eleven models tested through their APIs, average compliance rose from 42% when the request came in one piece to 82% when it was split in two. GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B each went from 0% to 100%.1115

The coverage agrees that the headline numbers need careful reading. Claude Sonnet 4.6 and Opus 4.6 show 0% in the published table. However, ASSET reports that in one test Sonnet still sent proprietary source code containing a live hardcoded key, while redacting the more obvious secrets.11 A 0% score therefore does not mean the model is unaffected. Each figure describes one specific test setup, not a general compliance rate.11

The scope of the work is also limited. The tests ran in isolated projects seeded with fake credentials, and no real-world intrusion has been reported. No CVE identifiers had been published as of August 10, 2026, pending coordinated disclosure.11 The attack also assumes the developer has already connected the attacker's MCP server and that the agent can already read the targeted files. It is not a way to break into an arbitrary agent from outside.1115

The most useful finding is about the model's surroundings, not a ranking of models. The same model refused in one coding client and leaked data in another, depending on the safety controls around it.11 ASSET also found that elaborate cover stories made attacks less effective, because they gave the model something false to question. A plain fill-in-the-blanks template did not.11

Where the coverage diverges

Secondary write-ups disagree on where the weakness lies. One practitioner analysis says any MCP-connected coding agent is exposed "because the attack is against the protocol, not the model."15 Another account suggests a malicious server could intercept a configuration request and copy secrets.14 That gets the mechanism wrong. The server never touches the files; it persuades the agent, which already has file access, to collect them and hand them over.11

The more accurate reading is that the weak point is the client harness. The MCP specification already says clients should let a human deny tool calls and must treat annotations from untrusted servers as untrusted.11 ASSET's recommendation goes further: treat server output as data rather than instructions, and never let values from one tool's output flow unchecked into another tool's arguments.11 That second rule is one most MCP clients do not currently enforce.15 Model alignment helps, but the results show it cannot carry the defense alone.

GhostSplice follows Ghostcommit, ASSET's June disclosure. In that attack, an instruction hidden inside a PNG referenced by a project convention file led a coding agent to encode .env secrets into source code as integers.11 The mechanics are different, but both point to the same conclusion: the boundary around the model can matter as much as the model.

Part of a wider pattern of agent-mediated theft

GhostSplice is one of several recent attacks in which the attacker never touches the secrets directly and gets a trusted agent to fetch them instead.

• Deadbugz (August 2026). A malicious MCP server was pushed through 23 GitHub pull requests within 74 minutes. It behaved normally for its first three tool calls, then rewrote its own tool metadata to send connected agents after SSH keys, AWS credentials, shell history and Kubernetes configuration, while hiding the activity from operators. No pull requests were merged. OWASP called it a runtime trust failure in an already-approved server.4
• Mitiga's poisoned take-home test. A fake interview repository contained no malware, only hidden instructions in CLAUDE.md, .cursor/rules, the README and an MCP config. With auto-run enabled, the agent harvested AWS credentials, mapped cloud and Kubernetes environments, and exfiltrated the results in under two minutes. The last step ran through a poisoned MCP tool named project-setup.env_check.8
• Unit42's MCP sampling research. Palo Alto Networks' Unit42 showed in 2025 that malicious servers could abuse sampling to hijack conversations and trigger hidden tool calls.18

Benchmarks point the same way. The MCPTox benchmark tested poisoned versions of 353 real tools against 20 models and recorded an average attack success rate of 36.5%, peaking at 72.8%.2 A New York Institute of Technology study of seven MCP clients found large differences between them: Claude Desktop had strong guardrails, while Cursor was highly susceptible to cross-tool poisoning.1 That matches ASSET's finding that the client decides much of the outcome.

Poor credential hygiene makes all of this worse. GitGuardian counted 24,008 unique secrets in public MCP-related config files on GitHub, and 2,117 of them were still valid.3 Hush Security, scanning about 82,000 public MCP files, found hardcoded secrets in 12% of credential fields, and 24% of those were both non-expiring and broad in scope.5

The A2A dimension: trust that travels

For enterprises building multi-agent systems, the risk extends beyond a single developer's laptop. Independent researcher Syed Anas Mohiuddin describes "protocol pivoting," in which a malicious instruction enters through MCP and is relayed to another agent over Google's Agent-to-Agent (A2A) protocol. Authorization often gets lost when the request crosses between protocols.21 He tested this against systems at Google, JP Morgan Chase, Rapid7 and government bodies. The Google flaw, in an MCP database toolbox that lacked redirect and IP validation, was rated 8 for severity.2130

The A2A specification has its own gaps. The A2ABreak paper reports eleven protocol-level vulnerabilities that a fully spec-compliant adversary could exploit, including cross-client context injection, loss of user identity across delegation hops, and self-declared skill claims that nothing verifies.23 The authors note that combining A2A and MCP creates an attack surface that neither specification addresses on its own.23 One protocol analysis observes that neither MCP nor A2A can record on whose behalf an agent is acting, or attach constraints such as "read-only" that the receiving side must honour.26

GhostSplice fits this setting closely. In a single coding session, a split instruction steals files. In an A2A chain, the same reassembly could happen across agents, with each one treating its upstream peer as trustworthy.2229

What enterprises should take from it

The practical advice is consistent across the coverage:

• Pin and allowlist MCP servers. Approve specific servers rather than letting developers connect anything.15
• Limit which tools can reach which files. A documentation scraper has no reason to read ~/.ssh.15
• Require human approval for filesystem and network tools, including read and search tools, which many agents leave ungated by default.15
• Apply least privilege to every agent.10
• Route agent-to-agent traffic through a gateway that authenticates each call and logs which identity was used.27

The July 2026 MCP specification revision improves authorization but does nothing about tool poisoning or malicious servers.3 Investors are moving into the gap: AIR Security raised $50 million and HiddenLayer $100 million in September for agent runtime security.9

GhostSplice is a lab result, not a breach, and it requires a developer to connect a hostile server first. Even so, it shows that scanning individual prompts for malicious content is not enough. Defenses need to track how data moves between tools, because the harmful instruction may only exist once the agent has put the pieces together.