Executive Summary
A malicious MCP server connected to an AI coding assistant can steal SSH keys, environment secrets, source code and customer data by splitting the theft into routine-looking fragments, even after a blunt request is refused.
What Happened
A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let
Vulnerability / Attack Technique
Fragmented instructions from a malicious MCP server
Technical Mechanism
The server places harmless-looking request fragments in channels the assistant already uses; together they assemble the exfiltration the assistant would refuse if asked directly.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Refusals evaluate one request at a time, so splitting defeats them. RealGround analysis: the control is not trusting the MCP server in the first place, and keeping secrets out of reach.
Recommended Controls
- Allowlist MCP servers for coding assistants
- Keep SSH keys and .env files out of the assistant's accessible paths
- Monitor assistant file reads of sensitive paths
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/malicious-mcp-servers-can-split.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.