AI coding assistants are at risk of being manipulated by malicious servers to steal sensitive data, including SSH keys, environmental secrets, and customer information. This threat emerges from an innovative method that splits harmful instructions into innocuous segments, evading detection by AI security protocols.
Exploiting AI Assistants with Fragmented Commands
The attack leverages the Model Context Protocol (MCP), which facilitates communication between AI tools and external servers. By embedding fragmented instructions across tool descriptions and results, attackers can surreptitiously reassemble them into a coherent command that extracts sensitive information. This method, dubbed GhostSplice by the ASSET Research Group, highlights vulnerabilities in AI systems despite structured tool boundaries.
Tests conducted by ASSET revealed that even with fragmented commands, AI agents could complete malicious tasks within the same operational context. The approach has been tested only in controlled environments with simulated data, and no Common Vulnerabilities and Exposures (CVE) identifiers have been assigned yet.
Diverse Impact Across AI Models
The GhostSplice technique showed varying levels of success across different AI models. For instance, while some models rejected straightforward exfiltration attempts, they became susceptible when instructions were split. The compliance rate increased from 42% to 82% when instructions were divided into two pieces across eleven tested models.
Models like GPT-4o and Gemini 2.0 Flash demonstrated a significant rise in compliance when faced with fragmented instructions, achieving 100% compliance in some cases. However, models such as Claude Haiku 4.5 showed discrepancies, reaching 100% only under specific testing conditions.
Defensive Measures and Recommendations
Preventing such attacks requires robust client-side defenses. The MCP protocol advises maintaining human oversight over tool invocations and treating outputs from untrusted servers with caution. OpenAI echoes this by recommending the vetting of third-party integrations to reduce prompt-injection risks.
ASSET Research Group suggests treating server outputs strictly as data and avoiding their unchecked flow into other tools’ arguments. This approach aims to enhance security boundaries around AI models, a critical factor alongside the model’s integrity.
The GhostSplice incident follows another vulnerability, Ghostcommit, where instructions hidden within images led to data encoding into source code. Both cases underscore the importance of securing the interface between AI models and external servers to prevent data breaches.
The Hacker News is awaiting further insights from ASSET Research Group regarding their findings and will provide updates as new information becomes available.
