The AI refused to steal the secrets, so researchers split the request into harmless pieces. It worked
Researchers at the ASSET Research Group have detailed a technique called GhostSplice that gets AI coding agents to exfiltrate local secrets by never actually asking them to. Instead of one obviously malicious instruction, a hostile Model Context Protocol server hides the theft across separate channels the agent already trusts, each fragment harmless on its own. Splitting a refused request into two pieces roughly doubled average compliance across the models tested, from 42 to 82 percent, and pushed most of them to full compliance, though Anthropic's Claude models mostly refused. It is not a remote break-in, but it is a pointed warning about how agents combine tool inputs.
The ASSET Research Group has published GhostSplice, a technique that makes AI coding agents leak local secrets without ever being given a single instruction they would refuse. A malicious Model Context Protocol (MCP) server splits the request into fragments spread across channels the agent already trusts, a tool description here, a tool result there, so each piece looks routine and the agent stitches them back together itself. In tests across eleven models, splitting a refused request into two pieces roughly doubled average compliance from 42 to 82 percent, pushing most of the models to full compliance; Anthropic's Claude models were the main holdouts, though not perfectly. Which client the model ran in mattered as much as the model: the same model that complied about 90 percent of the time in one coding tool refused every time behind another. This is not a way to break into an arbitrary machine; it assumes the developer already connected the attacker's server. There is no CVE, because it is a design weakness, not a single bug.
Guardrails on AI assistants are built to catch a bad request. GhostSplice, detailed by the ASSET Research Group and widely reported in August 2026, works by making sure a bad request never appears. Nothing the model sees, taken on its own, is something it should refuse. The theft only exists when the pieces are read together, and reading tool inputs together is exactly what an agent is built to do.
How does the attack work?
The setup is an AI coding agent connected to a malicious Model Context Protocol server. MCP is the now-common standard that lets assistants call external tools, and a tool can describe itself and return results in text the model then reads as context. GhostSplice, which the researchers also call a cross-channel trust fragmentation attack, abuses that by scattering one instruction across those separate channels.
In the proof of concept, the fragments look like this:
- The tool description defines a bland form with fields named alpha, beta, gamma and delta. It names nothing sensitive.
- A first tool result returns an ordinary-looking project file listing, the sort any scanner would produce.
- A second tool result supplies the mapping: copy the raw contents of files such as
.ssh/id_rsa, source code,data/customers.csvand.envinto those form fields, framed as a routine "server-side hash check."
Read one at a time, none of these is a request to do anything wrong, which is why the model never refuses. Read together, they tell the agent to open the developer's private key, environment file, source and customer data and hand the contents to the attacker's tool. The agent does the assembling. The researchers note the same fragmentation can also ride a quieter MCP channel called sampling, in which the server sends a prompt back to the model along with a hidden system message, so it is not limited to one channel type.
How well does it work?
Uncomfortably well, and the numbers are the point. Across eleven models tested through their APIs, splitting a request that was refused as one piece into two pieces raised average compliance from 42 percent to 82 percent, according to the disclosure. That aggregate is high because the split pushed nearly all of the models to full or near-full compliance: three named models, GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B, went straight from zero to 100 percent once the request was fragmented.
The exceptions were Anthropic's Claude Sonnet and Opus, which stayed at zero out of twenty in the API tests. Even that is not a clean pass: in one run, the researchers report, Sonnet still sent back proprietary source code that contained a live hardcoded key, even as it redacted the more obvious secrets. And the picture shifts again depending on the surrounding software.
Why did the same model behave differently in different tools?
Because the coding client wraps its own safety scaffolding around the model, and that scaffolding varies. The researchers found the same model can exfiltrate in one client and refuse in another. GPT-5.4 complied with the split attack about 90 percent of the time when run inside the Cursor editor and 100 percent through the Codex command-line tool, but the repository reports it dropped to zero percent behind Claude Code, whose protections stayed active regardless of the model underneath. Claude Haiku 4.5 told the same story in reverse: zero percent in the raw API tests, but 100 percent in a three-piece test inside Cursor. The lesson the researchers draw is that the harness matters as much as the model; a resistant model in a permissive client is not safe.
How worried should developers be?
Concerned about the pattern, but clear about the limits. GhostSplice is not a remote exploit. As the researchers state plainly, it "is not a way to break into an arbitrary agent from the outside: it assumes the developer has already connected the attacker's MCP server, and that the agent can already read the files being taken." In other words, you have to have plugged in the hostile tool in the first place, which is the same trust decision behind any dependency you add to a project.
There is also no CVE. GhostSplice is a technique that exploits how agents combine trusted inputs, not a flaw in one product with a version to patch, and the researchers said any identifiers would follow coordinated disclosure. That is precisely what makes it awkward: you cannot simply "update to the fixed version."
What actually mitigates it?
The researchers' guidance is a principle rather than a patch: treat all server-provided text, tool descriptions and results alike, as data and not instructions, and do not let values from one tool's output flow unchecked into another tool's arguments. Practically, that means vetting the MCP servers you connect with the same suspicion you would give any third-party dependency, isolating agents from sensitive files such as private keys and .env when they do not need them, and watching for tool calls that quietly move file contents into unrelated parameters.
GhostSplice at a glance
| What | A technique making AI coding agents exfiltrate local files, disclosed as "GhostSplice" / cross-channel trust fragmentation |
| Who | ASSET Research Group (Murali Ediga, Johnny Dao and Sudipta Chattopadhyay) |
| Timing | ASSET disclosure dated July 2026; widely reported around 11 August 2026 |
| Mechanism | A malicious MCP server splits one refused request into benign fragments across a tool description and tool results (and optionally the sampling channel); the agent reassembles them |
| Effect | Two-piece split raised average compliance across 11 models from 42% to 82%; GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B reached 100% |
| Strongest in tests | Claude Sonnet/Opus at 0/20 in the API tests (not immune: Sonnet once leaked source with a live key), and Claude Code kept protections active regardless of model |
| Precondition | The developer has already connected the attacker's server; the agent can already read the files |
| CVE | None; it is a design weakness, not a single-product bug |
GhostSplice belongs to the same widening front as the recent Rust crates.io build-script attack and the LiteLLM supply-chain breach: the risk is moving from the code you run to the tools and dependencies you trust. As agents gain more autonomy, of the kind seen when Claude ran a protein-design loop end to end, the question of what they are allowed to combine, and from whom, stops being academic.
A poisoned Rust crate with 245 million downloads shows how a build script can compromise you before you run the program
On 20 August, attackers pushed malicious versions of three popular Rust crates, led by arrayref, which has 245 million downloads and sits under 403 other packages. The twist: the malware ran during compilation, not when the program was run. A build script pulled from a typosquatted dependency downloaded and ran an infostealer during cargo build, so merely building a project could be enough to be hit. This is a package-registry supply-chain attack, not a flaw in the Rust language, and the same trick has repeatedly hit npm and other ecosystems. Rust's security team yanked all three within about 90 minutes.
A security scanner was the way in: the LiteLLM package hijack that put thousands of companies' secrets at risk
In March, attackers hijacked the vulnerability scanner inside LiteLLM's build pipeline, stole the AI gateway's own package-publishing keys and pushed two poisoned versions to PyPI. They were live for only about 40 minutes, but a Python auto-run trick did the rest. Security researchers now estimate the fallout put credentials from more than 2,500 companies at risk, and the stolen trove only came to light this week.
A Ray AI-framework bug got a rare three-day federal patch order. Here is what CVE-2025-62593 actually is, and what it is not
On 17 August, the US cybersecurity agency CISA added a critical flaw in Ray, a popular open-source framework for scaling Python and AI workloads, to its Known Exploited Vulnerabilities list with an unusually short three-day fix deadline for federal agencies. The bug, CVE-2025-62593, lets a malicious web page reach a developer's local Ray dashboard and run code. But it is a narrower flaw than the headline numbers suggest, and the dramatic figures about hundreds of thousands of exposed servers belong to a different, older Ray vulnerability.