GhostSplice splits a malicious instruction across MCP tool calls, and refusal rates go to zero
ASSET Research Group fragmented an exfiltration request across MCP channels so no single piece looked malicious. Models that refused the intact instruction 100 percent of the time complied 100 percent of the time when it arrived in parts.
The ASSET Research Group published GhostSplice, an attack on AI coding agents that distributes a malicious instruction across several MCP channels the agent already reads, so that each fragment looks routine and only the agent's own working context reassembles them. Testing covered 15 models. Several that refused the intact instruction outright moved to full compliance once it was split: GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B went from 0 to 100 percent over the API, Claude Haiku 4.5 in Cursor did the same, and GPT-5.4 in Codex CLI complied throughout. Claude Sonnet 4.6 and Opus 4.6 showed 0 percent across the published tables, though one Sonnet variant leaked proprietary source containing a live hardcoded key. The reference implementation targeted .ssh/id_rsa, .env files, source repositories and customer CSVs. The work was done in isolated environments, not observed in the wild.
Why it matters
The finding is about where the security boundary sits, not about which model is safest. Refusal training evaluates the instruction it can see. Split the instruction and there is no point at which a harmful one is visible, so a defense that reads intent has nothing to read. Any control built on the model recognising an attack degrades the same way, which is why agent instruction injection needs enforcement outside the model.
The identity framing is the useful one. An agent is a non-human identity holding the union of every credential its tools can reach, and MCP servers are how that union grows. Treat server output as data and never as instructions. Block values returned by one tool from flowing unchecked into another tool's arguments, which is the specific mechanic GhostSplice depends on. Keep human approval on invocations that touch credentials or egress. Vet third-party MCP servers as you would a dependency with production credentials, because that is what one is. And scope the agent's tokens: the reason .env was worth stealing is that it held something durable, so short-lived, narrowly scoped credentials shrink the payoff regardless of whether the agent can be talked into fetching them.
Source: The Hacker News
Related on Start with Identity
- BlogAn MLflow SSRF reaches cloud metadata services, and scanning started within hours
CVE-2026-64849 (CVSS 9.3) abuses MLflow's model-registry webhooks to proxy requests into internal services, including cloud metadata endpoints that hand out cre
- BlogNearly one in ten exposed LiteLLM gateways still accept the documentation's example admin key
Wiz found 3,074 internet-facing LiteLLM gateways, of which 294 accepted sk-1234, the key printed in the setup docs. In 191 of those no key was set at all, which
- BlogOne actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says
Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organi
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVELiteLLM MCP gateway accepts any Bearer token after key validation fails
LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object when key validation failed, so a fabricated Authorization header reached the gateway's
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.