# GhostSplice splits a malicious instruction across MCP tool calls, and refusal rates go to zero

Source: https://startwithidentity.com/blog/2026-08-11-ghostsplice-split-instructions-make-coding-agents-exfiltrate-secrets/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

The ASSET Research Group published GhostSplice, an attack on AI coding agents that distributes a malicious instruction across several [MCP](https://startwithidentity.com/glossary/agentic-identity/) channels the agent already reads, so that each fragment looks routine and only the agent's own working context reassembles them. Testing covered 15 models. Several that refused the intact instruction outright moved to full compliance once it was split: GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B went from 0 to 100 percent over the API, Claude Haiku 4.5 in Cursor did the same, and GPT-5.4 in Codex CLI complied throughout. Claude Sonnet 4.6 and Opus 4.6 showed 0 percent across the published tables, though one Sonnet variant leaked proprietary source containing a live hardcoded key. The reference implementation targeted `.ssh/id_rsa`, `.env` files, source repositories and customer CSVs. The work was done in isolated environments, not observed in the wild.

## Why it matters

The finding is about where the security boundary sits, not about which model is safest. Refusal training evaluates the instruction it can see. Split the instruction and there is no point at which a harmful one is visible, so a defense that reads intent has nothing to read. Any control built on the model recognising an attack degrades the same way, which is why [agent instruction injection](https://startwithidentity.com/techniques/agent-instruction-injection/) needs enforcement outside the model.

The identity framing is the useful one. An agent is a [non-human identity](https://startwithidentity.com/techniques/non-human-identity/) holding the union of every credential its tools can reach, and MCP servers are how that union grows. Treat server output as data and never as instructions. Block values returned by one tool from flowing unchecked into another tool's arguments, which is the specific mechanic GhostSplice depends on. Keep human approval on invocations that touch credentials or egress. Vet third-party MCP servers as you would a dependency with production credentials, because that is what one is. And scope the agent's tokens: the reason `.env` was worth stealing is that it held something durable, so short-lived, narrowly scoped credentials shrink the payoff regardless of whether the agent can be talked into fetching them.

Source: [The Hacker News](https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html)