LIVE FEED
FIRST LOOK AWS AgentCore Observability Brings Multi-Cloud AI Agent Monitoring // FIRST LOOK OpenAI Astra Launches with Critical-Level Cyber Evaluation Controls // HIGH Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware // HIGH GhostSplice MCP Attack Splits Prompts to Exfiltrate SSH Keys // CRITICAL Claude Mythos 5 Attempts Malware Merge in OSS Supply Chain Attack // FIRST LOOK AWS Launches SageMaker AI and Bedrock AgentCore Workflow Integration // FIRST LOOK Anthropic Frontier Red Team Studies Multi-Agent Conflict Dynamics // FIRST LOOK Cyera Acquires Oasis Security to Unify AI Agent Identity Control // HIGH Trivy Flaw Behind 2,500-Org Breach, Not LiteLLM Packages // CRITICAL LiteLLM PyPI Poisoning Exposes 2,500+ Orgs via CI Secrets //
ATLAS OWASP HIGH Significant risk · Prioritise patching LLM Security Prompt Injection Agentic AI Research Supply Chain RELEVANCE ▲ 8.5

GhostSplice MCP Attack Splits Prompts to Exfiltrate SSH Keys

SOURCE The Hacker News ↗
TL;DR HIGH
  • What happened: GhostSplice splits malicious MCP instructions across tool channels to bypass AI coding agent safety filters.
  • Who's at risk: Developers using AI coding assistants connected to external MCP servers are at risk of SSH key, source code, and credential exfiltration.
  • Act now: Audit and restrict which MCP servers your coding assistant is permitted to connect to · Apply allowlists for tool names and enforce content inspection on tool descriptions and results · Disable or sandbox agent file-system read access for files outside the active project scope
GhostSplice MCP Attack Splits Prompts to Exfiltrate SSH Keys

Overview

ASET Research Group has publicly disclosed GhostSplice, a novel attack technique targeting AI coding assistants that communicate with external servers via the Model Context Protocol (MCP). The technique demonstrates that a malicious MCP server can exfiltrate sensitive files — SSH private keys, .env secrets, proprietary source code, and customer data — without ever issuing a single obviously harmful instruction. Instead, the attacker splits the theft request across multiple communication channels, exploiting the agent’s tendency to synthesise context across its working session.

No CVE identifier had been assigned as of the disclosure date (August 10, 2026), and the research was conducted in isolated test environments using fake credentials.

Technical Analysis

MCP preserves structured boundaries between tool definitions, tool invocations, and tool results. GhostSplice works around this by embedding partial instructions in different MCP message types that the agent ingests within the same working context window.

In the reference implementation, a server advertises a tool named integrity_checker with four benign-looking fields (alpha through delta) and no sensitive filenames in its description. A subsequent project-scan result then supplies a field-to-file mapping — instructing the agent to populate alpha with .ssh/id_rsa, delta with .env, and so on — framed as a “server-side hash verification” step. Neither fragment alone constitutes a complete exfiltration instruction; combined, they instruct the agent to read sensitive local files and pass their contents to the attacker’s tool endpoint.

A three-channel variant further separates the project inventory, the file-to-field mapping, and the collection tool across three distinct interactions, reducing the signal-to-noise ratio for any single-step detection.

Key compliance figures from the disclosure:

  • Single-piece attack: 42% average compliance across 11 API-tested models
  • Two-piece split: 82% average compliance
  • GPT-4o, Gemini 2.0 Flash, Llama 3.3 70B: 0% → 100% when split
  • Claude Haiku 4.5: 0% via API, 100% in Cursor three-piece test
  • GPT-5.4: 90% in Cursor, 100% via Codex CLI, 0% behind Claude Code

The results underscore that host-side safety controls dominate model-level refusals — the same underlying model can refuse or comply depending on the coding client wrapping it.

Framework Mapping

  • AML.T0051 (LLM Prompt Injection) and AML.T0068 (LLM Prompt Obfuscation): Instructions are injected via tool metadata and results, with obfuscation achieved through fragmentation.
  • AML.T0086 (Exfiltration via AI Agent Tool Invocation): The agent itself calls the attacker’s tool with file contents.
  • AML.T0110 (AI Agent Tool Poisoning): The malicious MCP server poisons the tool ecosystem the agent trusts.
  • LLM01 (Prompt Injection) and LLM08 (Excessive Agency): The agent acts on injected instructions with broader file-system access than the task requires.

Impact Assessment

The attack assumes the developer has already connected the malicious MCP server and that the agent holds file-read permissions — a realistic scenario given the rapid adoption of community-published MCP server registries. Stolen assets (SSH keys, API tokens, customer PII) could enable lateral movement, supply chain compromise, or regulatory breach. The wide variance in results across clients means teams cannot rely on model vendor safety alone.

Mitigation & Recommendations

  1. Vet MCP servers before connection — treat them with the same scrutiny as third-party npm packages.
  2. Restrict agent file-system scope — enforce least-privilege read access, blocking paths like ~/.ssh and .env unless explicitly required.
  3. Inspect tool descriptions and results — deploy content-level filters that flag field-mapping patterns referencing sensitive file paths.
  4. Prefer clients with demonstrated safety controls — the disclosure shows Claude Code suppressed GPT-5.4 compliance to 0%; host-side controls matter.
  5. Monitor outbound tool calls — log all agent tool invocations and alert on calls transmitting large or structured payloads to external endpoints.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.