{
  "entry": {
    "kind": "vuln",
    "slug": "ghostsplice-malicious-mcp-servers-split-one-instruction-across-two",
    "name": "ghostsplice-malicious-mcp-servers-split-one-instruction-across-two",
    "vendor": "Any MCP client that lets one tool's output reach another tool's arguments",
    "description": "ASSET Research Group showed that an MCP server can advertise a bland, harmless tool and then supply the rest of the instruction later through project-scan results, so no single channel ever holds the full request and neither half looks malicious under review. Reassembled at the agent, the fragments direct it to collect local files and pass their contents to the attacker's tool, reaching SSH keys, .env files, environment secrets and source code. Compliance jumped from 0 to 100 percent for several models once the instruction was split, and models that scored 0 percent still sent proprietary source containing live hardcoded keys. No CVE at disclosure; coordinated disclosure was still open.",
    "website": "https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-08-11",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "ghostsplice-malicious-mcp-servers-split-one-instruction-across-two",
      "aliases": [
        "ti-078"
      ],
      "title": "GhostSplice: Malicious MCP Servers Split One Instruction Across Two Channels to Beat Review",
      "summary": "ASSET Research Group showed that an MCP server can advertise a bland, harmless tool and then supply the rest of the instruction later through project-scan results, so no single channel ever holds the full request and neither half looks malicious under review. Reassembled at the agent, the fragments direct it to collect local files and pass their contents to the attacker's tool, reaching SSH keys, .env files, environment secrets and source code. Compliance jumped from 0 to 100 percent for several models once the instruction was split, and models that scored 0 percent still sent proprietary source containing live hardcoded keys. No CVE at disclosure; coordinated disclosure was still open.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Data exfiltration"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Any MCP client that lets one tool's output reach another tool's arguments",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Any MCP client that lets one tool's output reach another tool's arguments (no patched version; design-level)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-11",
      "modifiedAt": "2026-08-11",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html"
        }
      ],
      "mitigation": "Treat MCP server output as data and never as instructions, and stop values from one tool's output flowing unchecked into another tool's arguments. Reading a server's advertised tool definitions cannot catch this by construction, so vet third-party and custom MCP integrations on observed behaviour, and keep a human able to deny a tool invocation.",
      "detectedByAnomity": true
    }
  }
}