GhostSplice: Malicious MCP Servers Split One Instruction Across Two Channels to Beat Review
GhostSplice: Malicious MCP Servers Split One Instruction Across Two Channels to Beat Review is a high-severity prompt injection issue in Any MCP client that lets one tool's output reach another tool's arguments, a MCP server. Affected: Any MCP client that lets one tool's output reach another tool's arguments (no patched version; design-level).
Is Any MCP client that lets one tool's output reach another tool's arguments running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
ghostsplice-malicious-mcp-servers-split-one-instruction-across-two- Severity
- high
- Attack type
- Prompt injection, Data exfiltration
- Component
- Any MCP client that lets one tool's output reach another tool's arguments · MCP server
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
ASSET Research Group showed that an MCP server can advertise a bland, harmless tool and then supply the rest of the instruction later through project-scan results, so no single channel ever holds the full request and neither half looks malicious under review. Reassembled at the agent, the fragments direct it to collect local files and pass their contents to the attacker's tool, reaching SSH keys, .env files, environment secrets and source code. Compliance jumped from 0 to 100 percent for several models once the instruction was split, and models that scored 0 percent still sent proprietary source containing live hardcoded keys. No CVE at disclosure; coordinated disclosure was still open.
Affected versions
| Affected | Fixed in |
|---|---|
Any MCP client that lets one tool's output reach another tool's arguments (no patched version; design-level) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Any MCP client that lets one tool's output reach another tool's arguments (no patched version; design-level).
How do I fix it?
Treat MCP server output as data and never as instructions, and stop values from one tool's output flowing unchecked into another tool's arguments. Reading a server's advertised tool definitions cannot catch this by construction, so vet third-party and custom MCP integrations on observed behaviour, and keep a human able to deny a tool invocation.
How do I find every machine running Any MCP client that lets one tool's output reach another tool's arguments?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any MCP client that lets one tool's output reach another tool's arguments and which version, then enforce a policy on it.