Full Report
A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let
Analysis Summary
# Tool/Technique: GhostSplice
## Overview
GhostSplice is a prompt-injection and data exfiltration technique targeting AI coding assistants that utilize the **Model Context Protocol (MCP)**. The attack involves splitting a malicious request into multiple, benign-looking fragments (e.g., tool descriptions and tool results) across different communication channels. When the AI agent aggregates these fragments into its working context, it inadvertently reconstructs the malicious instruction, leading it to exfiltrate sensitive data such as SSH keys, environment secrets, and source code.
## Technical Details
- **Type**: Technique (Instruction Splitting / Indirect Prompt Injection)
- **Platform**: AI Coding Assistants (e.g., Cursor, Claude Code, Codex CLI) using Model Context Protocol (MCP)
- **Capabilities**: Data exfiltration, credential theft, source code theft, bypassing safety guardrails
- **First Seen**: Reported August 2026 by ASSET Research Group
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1195.002 - Supply Chain Compromise: Compromise Software Dependencies** (Malicious MCP server integration)
- **TA0007 - Discovery**
- **T1083 - File and Directory Discovery**
- **TA0009 - Collection**
- **T1560 - Archive Collected Data**
- **T1552.001 - Unsecured Credentials: Private Keys**
- **TA0010 - Exfiltration**
- **T1567 - Exfiltration Over Web Service** (Exfiltration via LLM tool calls)
## Functionality
### Core Capabilities
- **Instruction Fragmentation**: Splitting a theft request into "fragments" that appear routine when viewed in isolation.
- **Context Stitching**: Exploiting the LLM's tendency to combine information from multiple protocol boundaries (tool descriptions + results) to form a coherent action.
- **Safety Bypass**: Circumventing model guardrails that would normally refuse a "blunt" request for sensitive files (e.g., `.ssh/id_rsa`).
- **Data Exfiltration**: Leveraging legitimate tool-calling features to send local file contents to an attacker-controlled MCP server under the guise of "verification" or "integrity checks."
### Advanced Features
- **Multi-Channel Variants**: A three-channel approach that separates the project inventory, the file-to-field mapping, and the collection tool across three distinct interactions.
- **Form-Based Lures**: Using plain "fill-in-the-blank" templates which are harder for the model to identify as malicious compared to complex governance narratives.
## Indicators of Compromise
- **File Hashes**: N/A (Methodology-based; reference implementation available at `github[.]com/asset-group/ghostsplice`)
- **File Names**: `.ssh/id_rsa`, `.env`, `customers.csv` (Common targets for exfiltration)
- **Network Indicators**:
- Connections to unauthorized or unvetted MCP servers.
- Exfiltration via attacker-controlled tool endpoints (e.g., `integrity_checker`).
- **Behavioral Indicators**:
- AI agent attempting to read sensitive files outside the immediate scope of a coding task.
- High volume of data being passed into "integrity" or "hash verification" tool parameters.
- Unexpected tool registration from third-party MCP servers.
## Associated Threat Actors
- **ASSET Research Group** (Discovered/Proof of Concept)
- Potential for adoption by supply chain attackers targeting developers via malicious "helper" tools.
## Detection Methods
- **Behavioral Detection**: Monitor for AI agents accessing sensitive directories (like `~/.ssh`) and passing that content to external API calls.
- **Output Inspection**: Analyze tool call arguments for high-entropy strings or structured data that matches sensitive local file formats.
- **Context Monitoring**: Implement systems to detect when an LLM context contains instructions sourced from external tool metadata that conflict with user-provided intent.
## Mitigation Strategies
- **Human-in-the-Loop (HITL)**: Enforce the MCP specification requirement that clients must keep a human in the loop to manually approve tool invocations.
- **Server Vetting**: Treat third-party MCP servers as untrusted code. Organizations should only allow integrations from a vetted "allowlist."
- **Data/Instruction Separation**: Follow the recommendation to treat server output strictly as data, not as instructions for the agent.
- **Principle of Least Privilege**: Ensure the AI agent process has minimal read permissions on the host file system.
## Related Tools/Techniques
- **Model Context Protocol (MCP)**: The standard being exploited.
- **Indirect Prompt Injection**: The broader class of attack GhostSplice belongs to.
- **Prompt Caching/Context Injection**: Techniques used to manipulate the LLM’s memory/context.