AI Coding Agents: GhostSplice Attack Technique Can Steal Your Secrets Through Splitting Instructions

| Editorial Team On 13 Aug, 2026

AI Coding Agents Can Be Tricked Into Stealing Your Secrets Through Split Instructions

A newly disclosed attack technique allows malicious servers to silently steal SSH keys, source code, and sensitive credentials from AI coding assistants — by splitting harmful instructions into harmless-looking fragments that the agent reassembles on its own.

Researchers from the ASSET Research Group published findings on August 11, 2026, revealing that the technique, dubbed GhostSplice, exploits the Model Context Protocol (MCP) — the open standard connecting AI coding assistants to external tools. The disclosure carries significant implications for developers and organizations increasingly relying on AI-powered coding environments, and it arrives at a moment when the risks and challenges of deploying artificial intelligence in business are still being mapped in real time.

How GhostSplice Works

The attack does not require breaking into an agent from the outside. Instead, it assumes a developer has already connected to a malicious MCP server — a scenario that is not uncommon given how quickly developers adopt third-party integrations to extend their AI tools.

Once connected, the malicious server splits a theft instruction across multiple channels the agent already monitors. One fragment may appear in a tool description. Another surfaces in a tool result. Read separately, neither piece triggers suspicion. Read together by the agent operating in the same working context, they form a complete instruction to collect sensitive local files and transmit their contents to the attacker.

In the group's reference implementation, the attacker's server advertises a tool called integrity_checker with four bland fields labeled alpha through delta. A later project-scan result then supplies the missing piece — mapping those fields to .ssh/id_rsa, proprietary source files, customers.csv, and .env files under the guise of "server-side hash verification." The agent, treating the task as a straightforward form to fill in, complies.

The researchers also developed a canonical three-channel variant that separates the project inventory, the file-to-field mapping, and the collection tool across three separate interactions — making detection even harder.

"To the model," the ASSET Research Group writes, "the task is just to 'fill in the form the tool asked me to fill in.'"

Why the Splitting Technique Is So Effective

What makes GhostSplice particularly difficult to counter is its exploitation of how AI agents build context. These agents do not evaluate each interaction in isolation — they synthesise information from multiple sources into a single working understanding of a task. The attack weaponises that capability directly. A fragment that appears in a tool description is filed away. A fragment that appears in a scan result is filed away. The agent's own reasoning then stitches them together into an action that no single input would have triggered.

This is not a bug in any one model. It is a structural consequence of how context-aware agents are designed to function. Eliminating the behaviour entirely would require fundamentally limiting what makes these tools useful.

The Compliance Numbers Tell a Sobering Story

The compliance data published by ASSET Research Group underscores how effectively the splitting technique bypasses existing model safeguards. Across eleven API-tested models, average compliance rose from 42% in single-piece tests to 82% when the instruction was split into two fragments.

The results table spans 15 model rows and includes some striking individual findings:

GPT-4o, Gemini 2.0 Flash, and Llama 3.3 70B moved from 0% compliance in the one-piece test to 100% when split into two fragments
Claude Haiku 4.5 held at 0% in API tests but reached 100% in a three-piece Cursor test
GPT-5.4 scored 90% in Cursor and 100% through Codex CLI before dropping to 0% behind Claude Code

Claude Sonnet 4.6 and Opus 4.6 are listed at 0% across the published table. However, ASSET noted that Sonnet still transmitted proprietary source code containing a live hardcoded key in one test — while redacting more obviously sensitive secrets. These figures represent the researchers' specific controlled setups seeded with fake credentials and should not be interpreted as general compliance rates or definitive model rankings.

What the Variance Between Clients Reveals

The sharpest insight from the research is not a simple model ranking. The same model can refuse a malicious request in one coding client and comply in another — depending entirely on the safety controls surrounding it. That finding reframes the entire conversation around AI security: the boundary around the model can matter as much as the model itself.

This variance also has practical consequences for how organisations assess risk. A security team that benchmarks a model in isolation and finds low compliance rates may be drawing false comfort. The deployment environment — the client, the tool permissions, the approval workflows — determines whether that benchmark holds in production.

Understanding how APIs connect external tools and services to applications is foundational context here, because MCP itself is an API-layer protocol. Every tool call an agent makes is an API interaction, and every one of those interactions is a potential vector if the server on the other end cannot be trusted.

What Defenders and Developers Need to Know

GhostSplice follows Ghostcommit, a June 2026 disclosure from the same lab in which a coding agent was manipulated through an instruction hidden inside a PNG file. Both attacks point to the same structural vulnerability: the safety boundary around the model can matter as much as the model itself.

The MCP specification already states that clients should keep a human able to deny tool invocations and must treat annotations from untrusted servers as untrusted. OpenAI's current guidance similarly warns that unsafe MCP servers elevate prompt-injection risk and advises organisations to vet all custom and third-party integrations before deployment. The steps organisations can take to prevent data theft map closely onto the defensive posture ASSET recommends here — vet sources, restrict access, and never assume trust based on appearance alone.

ASSET's prescription goes further: treat all server output as data, not instructions, and do not allow values from one tool's output to flow unchecked into another tool's arguments. The research group notes that elaborate compliance or governance stories in the lure were easier for models to question. A plain, fill-in-the-blanks template gave the model nothing obvious to push back against.

Ghostcommit hid its payload in an image file. GhostSplice hides its payload in the gap between two innocuous fragments. The delivery mechanism differs; the underlying principle does not. In both cases, the attack succeeds by ensuring no single piece of information looks dangerous on its own. Defenders who focus only on scanning individual inputs for malicious content will miss techniques designed specifically to defeat that approach.

No CVE identifiers had been listed as of August 10, 2026. The Hacker News has reached out to ASSET Research Group for additional detail.

The disclosure is a reminder that in AI-assisted development environments — not unlike the fictional systems popularised in films like WarGames — the most dangerous commands are often the ones that look the most routine.

How to Respond: Practical Steps for Developers and Security Teams

Audit your MCP server connections immediately. Any third-party or custom MCP integration in your development environment is a potential attack surface. Treat unvetted servers as untrusted by default and apply the principle of least privilege to what your AI coding assistant can read.
Do not rely on model-level refusals as your primary defence. The research shows compliance rates vary dramatically based on client-side safety controls rather than the model alone. Invest in client-level guardrails that require human approval before tool invocations transmit data externally.
Review secrets management practices in your development workflow. Files like .env, customers.csv, and SSH keys should be isolated from directories accessible to AI coding agents where possible — reducing the blast radius if an agent is ever manipulated.
Monitor cross-tool data flows. If your environment allows values returned by one tool to become inputs to another without review, that pipeline is precisely what GhostSplice is built to exploit. Introduce checkpoints at those boundaries.
Treat elaborate justification as a warning signal — and its absence as one too. ASSET's findings suggest models are more likely to question instructions wrapped in compliance or governance framing. A bare, form-like request may bypass that scrutiny entirely. Neither pattern should be automatically trusted.