GhostSplice attack in two parts lifted compliance from 42% to 82%
The researchers tell that one model did the attack 90% of the time in one coding tool. In a different tool, it did so 0% of the time.
Researchers at the University of Missouri Kansas City published GhostSplice in July 2026. It shows that a malicious MCP server (a tool server that a coding assistant uses) can make an AI coding agent give out SSH keys, source code and customer records. In tests of eleven models, a refused request in pieces lifted average compliance from 42% to 82%.
How it works
The server shows a tool with four empty fields and a plain description. Then the result of a usual scan tells the agent to put the contents of four named files in those fields.
No part asks for theft. Thus no scanner sees a threat and no model refusal starts.
The numbers
In API tests, GPT-4o went from 0% to 100% compliance when the request was in two parts. Claude Sonnet 4.6 and Claude Opus 4.6 stayed at 0% in all tests.
The tool is important too. GPT-5.4 did the attack 90% of the time in Cursor and 0% in Claude Code, according to the researchers.
What is not known
No CVE (public vulnerability number) exists, and all credentials were fake. The results are from the authors’ own tests. Two known protections stopped one model. They did not help much with a different model. No fixed rule works for all models.
Insight: The tool around the model sets the risk
BeyondTrust says 85% of the coding agent users it saw had an MCP server. Symantec found an attack agent that looks for open MCP servers. This reads as a new weak point: the model can be safe, but the tool and server around it decide the result. Tell vendors to show the safety layer of the coding tool, not only the model name.
Sources
Posted
