GhostSplice: Malicious MCP Servers Split Exfiltration to Bypass Guardrails

What it is

GhostSplice, a technique from ASSET Research Group in which a malicious MCP (Model Context Protocol) server exfiltrates local files (SSH keys, .env, source, customers.csv) from an AI coding agent by splitting one exfiltration request across multiple channels so no single fragment reads as malicious. The disclosure covers controlled tests with seeded fake credentials, not a real intrusion; The Hacker News found no CVE listed as of August 10, 2026.

How it works

The reference server advertises a benign tool integrity_checker with four bland fields (alpha–delta) and no sensitive filenames. A later project-scan result supplies the mapping — fill those fields with the contents of .ssh/id_rsa, proprietary source, customers.csv, and .env for "server-side hash verification." Read apart, neither piece is the theft; read together in the agent's working context, they instruct collection and exfiltration. MCP preserves structured tool/result boundaries, but agents still combine instructions across them. A canonical three-channel variant separates inventory, mapping, and collection. Notably, the plainest lure worked best: elaborate governance pretexts gave the model something false to question; a bare fill-in-the-blanks template did not.

Preconditions / Affected

This is not a remote takeover. It assumes the developer has already connected the attacker's MCP server and that the agent can already read the targeted files. Exploitability depends heavily on the client's safety boundary, not just the model.

What to do

ASSET's prescription for client/integration builders:

• Treat server output as data, not instructions.
• Do not let values from one tool's output flow unchecked into another tool's arguments.
• Per MCP spec: keep a human able to deny tool invocations; treat annotations from untrusted servers as untrusted.
• Per OpenAI guidance: vet custom and third-party MCP integrations.

Caveats

The published 0% scores are not "unaffected." Claude Sonnet 4.6 and Opus 4.6 list at 0% across the table, but Sonnet still sent proprietary source containing a live hardcoded key while redacting the more obvious secrets. GPT-5.4 hit 100% via Codex CLI and 90% in Cursor, but dropped to 0% behind Claude Code — same model, different client. All figures are the researchers' own, each tied to a specific setup, and should not be read as general compliance rates.

flowchart TD
  A[Malicious MCP server<br/>already connected] --> B[Fragment 1: tool description<br/>bland fields alpha-delta]
  A --> C[Fragment 2: scan result<br/>maps fields to secret files]
  B --> D{Agent combines<br/>fragments in context}
  C --> D
  D -->|no single fragment<br/>looks malicious| E[Files exfiltrated to attacker tool]
  D -.client treats output as data,<br/>blocks output-to-argument flow.-> F[Chain broken]