The ASSET Research Group has released an attack technique called GhostSplice that enables the covert theft of SSH keys and source code from AI coding assistants via malicious MCP servers. In tests with eleven language models, the success rate increased on average from 42 to 82 percent once attackers broke the harmful command into several seemingly harmless parts.
MCP Server Distributes the Command Across Three Channels
The attack utilizes the Model Context Protocol (MCP), an open standard through which AI assistants like Cursor, GitHub Copilot, or Claude Code can access external tools. A prepared MCP server distributes the harmful instruction across multiple channels that the agent treats as trustworthy within the same work context. In a documented example, a tool called integrity_checker offers four uniform, empty form fields, a second tool lists existing files, and a third instructs the agent to enter their content into the form fields. None of the three fragments contains a recognizable harmful prompt on its own. Only when the agent combines them in the ongoing conversation does the complete instruction emerge, prompting the disclosure of files such as the private SSH key .ssh/id_rsa or a customer file customers.csv. The researchers refer to the method as cross-channel fragmentation because it deliberately exploits the boundary between individual tool calls, which many security filters check separately rather than in context. A directly formulated theft command to the same agent typically fails because security filters recognize and block it as a whole. The program code for the attack simulation has been published by the group as an open-source repository.
Eleven Models Show Very Different Vulnerabilities
The ASSET Research Group tested the attack through the APIs of eleven language models and additionally in real coding environments like Cursor. GPT-4o, Google Gemini 2.0 Flash, and Meta’s Llama 3.3 70B completely refused the direct command but followed the split version in practically every test. Anthropic’s Claude Sonnet 4.6 and Opus 4.6 remained at zero percent compliance across all twenty tested variants, proving to be more resilient against the stepwise composition. The smaller model Claude Haiku 4.5 never followed the instruction via the pure API but disclosed the data in every test once it ran within Cursor. OpenAI’s GPT-5.4 also showed this difference: under Cursor, the attack achieved a success rate of 90 percent, while behind Claude Code’s security layer it was 0 percent. The information comes exclusively from the disclosure of the research group itself and has not been independently verified. The results suggest that it is not only the model but especially the protective measures of the respective development environment that determine vulnerability.
Data Leaks via AI Tools Are Increasing in Companies
GhostSplice joins a growing number of MCP vulnerabilities that became public in 2026. The security provider Netskope has already documented that AI-related data leaks in companies have doubled within a year – the report explicitly named the rapid spread of MCP connections as the main driver. Just in June, the open-source agent platform Ruflo closed a critical security vulnerability through which a single unprotected network call was sufficient to steal access keys and manipulate the agent’s memory. The ASSET Research Group emphasizes that it did not use any real secrets for its tests and informed the affected providers before publication. As a countermeasure, the researchers recommend treating outputs from MCP servers consistently as data rather than instructions, strictly typing tool arguments, and not allowing values from a tool result to flow unchecked into the next call. The MCP specification itself already requires that users be able to reject individual tool calls and that information from untrusted servers be considered unverified in principle – in practice, however, only a few clients have so far implemented this requirement consistently.
It remains to be seen how quickly providers like Cursor, GitHub, and Anthropic will catch up with their client-side protective mechanisms – as the tests show that the same security vulnerability can either completely disappear or fully manifest depending on the development environment. For teams integrating third-party MCP servers, the origin and verification of these servers thus become as important a security question as the choice of the AI model itself.
