GhostSplice Reassembles Hidden Attacks Across MCP Messages
Key Takeaways
- Attack instructions were divided across separate MCP surfaces.
- Individual fragments appeared less suspicious when inspected alone.
- Agents reconstructed the combined intent during normal reasoning.
- Demonstrations targeted files, credentials, code, and customer data.
- The attack requires connection to a malicious MCP server.
Fragmented MCP Content Reassembled Into Malicious Intent
GhostSplice is a laboratory technique in which a malicious MCP server divides an attack across tool descriptions, tool results, and sampling responses. Each fragment may appear harmless to a control inspecting messages individually.
The Hacker News reported that agents could reconstruct the combined instructions and expose sensitive local or enterprise information.
What We Know
The technique was publicly disclosed and widely reported on August 11, 2026. The technical advisory describes malicious MCP servers distributing complementary instruction fragments across several parts of an agent’s interaction. The agent combines those fragments in its context and infers the attacker’s full objective.
Reported targets included SSH keys, environment files, source code, and customer information. Researchers compared unsplit and split payloads across multiple API-accessible models and reported substantially higher average compliance for the split approach.
Those percentages are specific to the tested prompts, models, tools, and experimental setup and should not be treated as universal exploit rates. The scenario requires connection to an attacker-controlled or compromised MCP server, and the agent must possess tools or file access capable of reaching the targeted data.
What Could Happen
An attacker publishes or compromises an MCP server that appears useful. Instead of placing a complete malicious instruction in one obvious field, the server distributes the request across metadata and runtime responses.
One fragment may define a role, another may identify a file, and another may supply an external destination or instruction to conceal the operation.
- A gateway, model filter, or security reviewer that evaluates each element independently may not detect the combined intent.
- The connected agent, however, maintains conversational state and can integrate all fragments into a coherent plan.
- If the agent has file, shell, network, repository, or SaaS permissions, it may retrieve secrets and transmit them through an allowed tool call.
Why It Matters
MCP servers are becoming a reusable integration layer between agents and enterprise resources. A single connection can expose tools, credentials, files, databases, and business applications. GhostSplice shows that a server does not need to present an obviously malicious command to shape agent behavior.
The risk may appear only at the session level, after multiple messages, tools, and model decisions are correlated. This complicates point controls that scan one prompt or response at a time.
The absence of confirmed exploitation limits realized impact, but the demonstrated targets include credentials and proprietary data with meaningful security and compliance consequences.
PointGuard AI Perspective
PointGuard AI treats MCP as a security boundary requiring both component trust and runtime enforcement. The MCP Security Gateway centralizes agent identity, tool authorization, content guardrails, data protection, and observability across MCP interactions.
Adaptive Red Team Testing can evaluate multi-turn and indirect prompt-injection paths that span tool descriptions, results, and connected workflows. AI Data Protection helps detect and control sensitive information moving through prompts, responses, and tool traffic.
Defenses should reconstruct the same session context available to the agent, correlate fragments across messages, and evaluate the final proposed action against policy. A server’s reputation or static scan is useful, but authorization should still limit which files, tools, and destinations an agent can reach.
Organizations should maintain an inventory of MCP servers, publishers, versions, tools, owners, and observed behaviors, then reassess risk when any element changes.
Incident Scorecard Details
Total AISSI Score: 7.1/10
Criticality: 8, Demonstrations targeted credentials, source code, customer information, and local files. AISSI weighting: 25%
Propagation: 8, Fragments can span MCP fields, turns, tools, models, and connected resources. AISSI weighting: 20%
Exploitability: 5, A public proof of concept exists, but active exploitation was not reported. AISSI weighting: 15%
Supply Chain: 8, The attack relies on external MCP servers and agent tool ecosystems. AISSI weighting: 15%
Business Impact: 6, The potential exposure is serious, while verified business harm remains absent. AISSI weighting: 25%
Sources
Third-Party Sources
AI Security Severity Index (AISSI)
0/10
Threat Level
Criticality
8
Propagation
8
Exploitability
5
Supply Chain
8
Business Impact
6
Scoring Methodology
Category
Description
weight
Criticality
Importance and sensitivity of theaffected assets and data.
25%
PROPAGATION
How easily can the issue escalate or spread to other resources.
20%
EXPLOITABILITY
Is the threat actively being exploited or just lab demonstrated.
15%
SUPPLY CHAIN
Did the threat originate with orwas amplified by third-partyvendors.
15%
BUSINESS IMPACT
Operational, financial, andreputational consequences.
25%
Watch Incident Video
