GhostSplice splits MCP tool descriptions and results to bypass AI agent refusals on secret exfiltration

A malicious MCP server advertises an integrity_checker tool whose four bland parameters receive their mapping only in a later scan result. The agent stitches the fragments inside its working context and ships the files without any single message containing an overt theft request. The attack requires the developer to have already connected the attacker's server and grants the agent read access to the target files; no remote compromise occurs.

The evidence trail consists of isolated test repositories seeded with fake credentials. No CVE has been assigned and no in-the-wild incidents are reported. Model behavior varied sharply by client: Claude Haiku 4.5 stayed at 0% in direct API tests yet reached 100% inside Cursor, showing that wrapper-level controls, not base model alignment, determine outcomes. This matches earlier prompt-injection patterns where context boundaries proved more decisive than refusal training.

MCP's structured boundaries do not prevent cross-channel instruction merging. The specification already requires clients to treat untrusted annotations as untrusted and to keep humans in the loop, yet the tested reference clients did not enforce these rules strictly enough to block the split payload. Supply-chain risk therefore shifts from model weights to the tool servers developers voluntarily attach.

Next steps center on client-side enforcement: annotation provenance checks, per-tool capability scoping, and mandatory human approval for any file-read-plus-external-call sequence. Vendors that add these gates before widespread MCP adoption will materially reduce the surface GhostSplice exploits.