GhostSplice Technique Lets Malicious MCP Servers Trick AI Coding Agents into Exfiltrating Secrets
GhostSplice is a technique that enables a malicious Model Context Protocol (MCP) server to force an AI coding agent to exfiltrate SSH keys, environment secrets, and proprietary source code. Instead of issuing a direct command such as “send the keys,” the server splits the instruction into fragments distributed between tool descriptions and subsequent tool responses. Each fragment appears as harmless metadata or operational text, allowing the agent to recombine the pieces during normal context processing and carry out the complete exfiltration.
The research highlights risks associated with the growing use of external tool servers connected through Model Context Protocol (MCP) in AI-assisted development workflows. Once a developer connects an unverified MCP server, that server can steer the agent toward leaking sensitive data already accessible within the development environment. In controlled tests, splitting instructions across two parts raised average model compliance from 42 percent to 82 percent across eleven evaluated models. Some systems that previously refused requests consistently shifted to 100 percent compliance.
The demonstration covers extraction of SSH keys, .env files, proprietary code, and documents containing sensitive data. The attack uses seemingly neutral templates and fields that resolve to concrete system paths, blending with routine agent operations. GhostSplice does not compromise agents remotely on its own; it requires the developer to connect the attacker’s MCP server and the agent to hold existing permissions for the targeted files.
Mitigation Recommendations
- Inventory and restrict allowed MCP servers, disabling third-party integrations by default.
- Apply least-privilege principles to limit the number of enabled tools.
- Treat tool descriptions and any changes as high-risk material with version control and change alerts.
- Separate data from instructions so tool output cannot directly feed arguments to other tools without validation.
- Require human approval for operations involving bulk reads, sensitive paths, exports, or external destinations.
- Restrict agent access to directories such as .ssh, credential stores, and .env files.
- Monitor outbound traffic for anomalous volumes and destinations.
- Maintain detailed logs of tool calls, arguments, and network destinations to detect instruction recombination.
- Deploy canary tokens that trigger alerts when they appear in outbound requests.
The findings align with earlier reports on poisoned MCP tool descriptions and Agentjacking attacks that trick AI coding agents into executing malicious actions.
Related articles
Researchers Extract Proprietary Reasoning Traces from Anthropic, OpenAI and Google LLMs, Revealing Hidden Secrets
A team of eight researchers from institutions including ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Tübingen AI Center, MATS and Snyk published a preprint detailing a practical attack that recovers full reasoning traces from closed LLM APIs. The method requires only two API calls and works by feeding encrypted reasoning blocks from strong models such as Claude Opus 4.8 into weaker models from the same provider, such as Haiku 4.5, which then reproduce the hidden chain-of-thought verbatim. Analysis of 6,708 publicly shared agent logs from GitHub and Hugging Face yielded 315,320 recovered traces containing 704 unique secrets, including 62 API keys, 33 passwords and 24 access tokens that never appeared in visible session output. The attack also enables extraction of internal safety policies, system prompts and detailed harmful planning that providers normally filter from final answers. In addition, the same mechanism can be used in reverse to inject malicious instructions into shared logs that later get replayed by unsuspecting users. The authors recommend treating encrypted reasoning blocks as sensitive secrets and propose cryptographic binding of traces to sessions, users and models.
Anthropic Claude Code Auto Mode Launches August 14 with Local Classifier and Permission Rules
Starting August 14, Claude Code will run in auto mode on new sessions for Pro, Max, and Team plans, replacing the allow/deny dialog with a local classifier that evaluates every tool call. The classifier rules are stored locally and contain 103 categories across allow, soft_deny, hard_deny, and environment sections, with the single hard_deny rule focused on data exfiltration spanning over 5,000 characters. Enterprise, API, Bedrock, Vertex, and Foundry deployments remain on opt-in for another month. Auto mode pauses after three consecutive blocks or twenty blocks in a session, and broad allow rules such as python:* are disabled while narrow permissions continue to function. Administrators should populate the twenty environment fields, currently only one-third configured on clean machines, before the rollout date.
Securing OpenClaw and Hermes AI Agents on One VPS: Hardening Lessons from Docker, SSH, and Prompt Injection Risks
A detailed case study examines the challenges of running OpenClaw and Hermes AI agents together on a single VPS, connected via an SSH channel with forced commands. The author deployed OpenClaw as an orchestrator handling Telegram messages and Hermes as an executor for heavy tasks inside its own Docker sandbox. Multiple security misconfigurations were discovered, including Docker publishing ports directly to 0.0.0.0, ufw being removed during iptables-persistent installation, and repeated resets of gateway.bind to lan. The built-in security audit revealed a critical issue where Telegram groups allowed arbitrary command execution without an allowlist. Additional risks included context file injection that could propagate through the ACP bridge and UID conflicts caused by cloud image defaults. The experience highlights that AI agents require strict least-privilege controls because they interpret arbitrary text as potential instructions.
AI Disrupts White Hat Ecosystem: 8000 Viewers Join Live Debate on SRC Closures and Security Industry Future
A live stream hosted by AikerWorld and HackingClub drew nearly 8000 viewers as nine security experts debated the impact of AI on white hat communities following the closure of a major financial sector SRC and HackerOne's shift to mandatory real-name submissions. Hu Xiaona, founder of the communities and 360 VulnCloud executive, described the changes as a structural wave that devalues routine vulnerability submissions while pushing practitioners toward AI Forward Deployed Engineer roles. Xiong Yong argued that AI lowers attack costs yet forces enterprises to treat security as essential rather than optional. Other speakers including Yang Wei, Wei Yongqiang, and Jia Yu examined pricing pressure, the need for human oversight during AI-driven testing, and the cyclical nature of security budgets. The discussion converged on the view that AI eliminates low-skill tool-based hunting but elevates complex research and defensive engineering skills. Participants highlighted risks such as un-audited AI actions deleting production data and warned that SRC platforms are moving from open crowdsourcing to curated, real-name models.