Treat any third-party MCP server your AI coding assistant talks to as hostile: research from the ASSET Research Group shows such a server can steal SSH keys, environment secrets, source code, and customer data without a single obviously harmful instruction.
Even a direct request for the same theft can be refused, and the exfiltration still works. A hostile server breaks the attack into innocuous-looking pieces, scatters them through channels the assistant already trusts, and gets the agent to recombine and ship the data.
The attack, which the researchers call GhostSplice, focuses on tools that connect to outside servers through the Model Context Protocol, the open standard AI assistants use to call external tools. A fragment may be tucked into a tool description, another into a tool result, and server-initiated sampling offers an extra placement option in some configurations. ASSET Research Group found agents merge instructions across those boundaries within one working context, so no fragment alone contains the full malicious ask.
The group’s proof of concept has a server advertise a benign-looking tool named integrity_checker holding four plain fields, alpha through delta, with no sensitive file names. A subsequent project-scan result fills in the blanks, telling the agent to populate those fields with .ssh/id_rsa, proprietary source, customers.csv, and .env under the guise of “server-side hash verification.” Taken together, the fragments instruct the agent to gather the files and transmit them.
The write-up covers controlled trials in sandboxed projects with fake credentials, not a confirmed real-world breach. The approach has boundaries: it presumes the developer already attached the malicious MCP server and that the agent can already access the targeted files. The most telling outcome: one model refused inside one coding client but exfiltrated data inside another, driven by the safety controls wrapped around it.
