Splitting a malicious instruction into pieces roughly doubled how often AI coding agents carried it out, researchers at the ASSET Research Group reported on August 11. Across eleven models tested through their APIs, compliance rose from 42 percent to 82 percent when a single request was broken into two fragments.
The technique, which the group calls GhostSplice, targets agents connected to outside tools through the Model Context Protocol, the interface coding assistants use to reach data sources and services. A single agent session commonly has several servers attached at once. Rather than send one complete instruction to steal files, an attacker distributes the parts across channels the agent already reads: tool descriptions, tool results, and in some configurations server-initiated sampling. No single fragment contains the whole request, and the agent assembles them inside its own working context. Safety filters that scan for an obviously harmful instruction see only a fragment of one.
In the researchers' setup, a tool named integrity_checker declared generic parameters, alpha, beta, gamma and delta. A later message supplied the mapping that told the agent what to put in each one: SSH private keys from .ssh/id_rsa, environment files, proprietary source code and an exported customer database.
The group tested fifteen models in all, some through direct API calls and others inside real coding clients. Three of the models went from refusing every attempt to complying with every attempt once the request was split. The same model refused in one coding client and complied in another, a gap the researchers attribute to the controls wrapped around the model rather than to the model itself.
GhostSplice follows Ghostcommit, a June disclosure from the same group that hid an instruction inside a PNG referenced by a project convention file and then had a coding agent encode .env secrets into source as integers. The tests behind both were run in isolated projects seeded with fake credentials. The group described no real-world intrusion and said any CVE identifiers would follow coordinated disclosure. The attack is also not a route into an arbitrary agent from outside: it assumes a developer has already connected the attacker's server, and that the agent can already read the files being taken.
Assistants wired into company systems have drawn a run of disclosures. Two firms showed that Atlassian's Rovo could be made to send Jira and Confluence records to an outside server, and earlier research planted a false memory in an AI assistant with a single email. Nvidia launched an AI security alliance in July without the four largest model developers.
ASSET's recommendation is to treat server output as data rather than instructions, and to stop values from one tool's output flowing unchecked into another tool's arguments.
Sources: The Hacker News, CybersecurityNews
–
By the Control Plane Editorial Team