Researchers Trick AI Coding Agents by Splitting Malicious Commands

Asked directly to send someone else's SSH keys, an AI coding agent refuses. But when the same request reaches it in pieces, hidden inside a tool description and inside the tool's output, many agents will stitch the command back together themselves and execute it without asking. That's how GhostSplice works, a technique described by the ASSET research group at the University of Missouri-Kansas City.

How the Form Trick Works

The Model Context Protocol, the standard connecting AI agents to external tools, lets an MCP server deliver content through several independent channels at once: the tool description, the tool's output, and in some configurations, sampling messages too. ASSET's researchers showed that all of these channels land in one shared block of the agent's working memory, with no marker showing which fragment came from where.

In the reference example, the team built a fake MCP server advertising a harmless-looking tool called integrity_checker, with four empty fields labeled neutrally as alpha, beta, gamma, and delta. Only the output of a separate, previously invoked project-scanning tool contained the mapping of which field should hold the SSH key, which the source code, which customer data, and which the contents of the .env file, ostensibly for server-side checksum verification.

To the model, the task boils down to filling out the form the tool asked for. - ASSET Research Group

Same Model, Different Outcome

The most troubling part of the study is how much the outcome varies depending on the environment the same model runs in. Claude Haiku 4.5 refused the attack in direct API tests, but gave in every single time inside Cursor. GPT-5.4 showed a 90 percent attack success rate in Cursor, 100 percent via Codex CLI, but 0 percent behind Claude Code's security layer. Claude Sonnet 4.6 and Opus 4.6 performed best, with zero success in most scenarios, though the researchers noted isolated cases where Sonnet still exposed fragments of source code containing hardcoded access keys.

That means a model's name and version alone don't say enough about its resistance to this type of attack. What matters is the security layers imposed by the specific client the agent runs in. Their presence or absence in a given development environment can shift the outcome from complete refusal to a 100 percent leak rate.

Why Earlier Safeguards Fall Short

The authors of the MCP specification, along with OpenAI, recommend that a human retain the ability to reject every tool call, and that annotations from untrusted servers be treated as untrusted data. These guidelines have been in the documentation for a while, but GhostSplice shows they aren't enough on their own when the malicious content never appears in one place as a complete request, instead being made up of fragments scattered across channels the agent processes routinely anyway.

ASSET proposes a more restrictive approach: treat the entire output of a tool call as data, never as an instruction, and block cases where a value returned by one tool flows, unverified, into the arguments of another tool call. That would require architectural changes in how MCP clients manage conversation context, not just one more filtering rule bolted on.

What It Means for Companies Using Coding Agents

The researchers stress that GhostSplice is not an external break-in: the attack requires a developer to connect a malicious or compromised MCP server to their own environment, and the agent must already have permission to read files such as SSH keys or .env. In practice, that points to a supply-chain risk in developer tooling, a fake or impersonating MCP package in a public registry, rather than a direct attack on a company's infrastructure.

For development teams in Poland increasingly connecting coding agents to their own repositories and databases, the takeaway is concrete: a model provider's reputation alone doesn't protect against this kind of manipulation, and every additional MCP server automatically widens the attack surface by adding another channel through which an instruction can be smuggled in pieces. Auditing MCP sources and limiting agents' file-read permissions is becoming just as important as choosing the model itself.

GhostSplice's proof-of-concept code is publicly available on GitHub, which should help security teams test their own deployments, but also raises the question of how quickly similar fragmentation techniques will show up in real-world campaigns against companies using AI agents in day-to-day development work.