A malicious tool server can quietly steal SSH keys, environment secrets, source code, and customer data without sending any obvious harmful instructions. This technique works even when a less aggressive version of the theft is rejected: by breaking down the request into smaller fragments that appear routine, placing them in channels already used by the assistant, and letting it stitch them back together before sending the data back. The attack targets coding tools that connect to external servers via the Model Context Protocol (MCP), an open standard allowing AI assistants to call external tools.
Despite this, ASSET Research Group's tests reveal that agents can still intermix instructions within the same working environment, ensuring no single fragment holds the entire malicious request.
The headline scores require attention. Claude Sonnet 4.6 and Opus 4.6 are marked at 0% in the published table, but ASSET indicates that Sonnet still sent a proprietary source containing a live hardcoded key during one test while redacting obvious secrets. OpenAI also advises against using unsafe MCP servers, emphasizing prompt-injection risks and recommending organizations to thoroughly vet custom and third-party integrations.
GhostSplice builds upon Ghostcommit's June disclosure from the same lab, which hid an instruction within a PNG referenced by a project convention file and allowed a coding agent to encode .env secrets into source as integers.
