ASSET Research Group disclosed GhostSplice on Aug. 10, showing that a malicious Model Context Protocol (MCP) server can split a theft request across tool descriptions and tool results and still get AI coding agents to hand over SSH keys, .env values, source code, and customer data.
The attack works because each fragment looks harmless on its own: one piece names routine fields, another supplies the missing mapping later, and the agent recombines them in its working context before it acts. In tests on 11 API-accessible models, split prompts were far more effective than one-piece requests, and the same model could refuse in one client but comply in another depending on the surrounding safety controls.
The exposure sits with any coding assistant that can read local files and call external tools, not just with MCP itself. If your agent already has workspace access, a server-side content control failure can become a path to anything that workspace can see.