Most prompt-injection defences work on the assumption that the malicious instruction exists somewhere as a coherent instruction — in a page, a file, a tool description — and can therefore be detected, filtered or refused.
GhostSplice, disclosed by the ASSET Research Group with a reference implementation on their public GitHub, attacks that assumption directly. The technique splits the request into fragments that each look routine, places them in channels the assistant already uses, and lets the agent stitch them together.
Nothing the model sees is an instruction to exfiltrate anything. The exfiltration is an emergent property of the pieces.
How the pieces fit
The demonstration uses a harmless-looking MCP tool called integrity_checker with bland parameters — alpha through delta. There is nothing to refuse there; it is a tool that checks integrity and takes four fields.
The mapping from those fields to sensitive file paths arrives separately, inside a project-scan result. Also unremarkable on its own: a scan result that mentions where things live.
The agent holds both. It fills alpha through delta with the contents of the mapped paths, because that is what the two pieces, together, describe.
A three-channel variant goes further, separating project inventory, file-to-field mapping, and collection across different interactions.
The numbers
Across eleven API-tested models, splitting the instruction into two pieces moved average compliance from 42% to 82%.
The per-model figures are starker.
| Model | Single instruction | Split |
|---|---|---|
| GPT-4o | 0% | 100% |
| Gemini 2.0 Flash | 0% | 100% |
| Llama 3.3 70B | 0% | 100% |
| Claude Haiku 4.5 | 0% (API) | 100% (Cursor, three-piece) |
A model at 0% is not a model that resists this class of attack. It is a model that recognised a coherent malicious request. Remove the coherence and the refusal has nothing to fire on.
GPT-5.4 ran between 90% in Cursor and 100% in Codex CLI — and 0% behind Claude Code. Same model, three harnesses, three results.
Claude Sonnet 4.6 and Opus 4.6 show 0% in the published tables, though the researchers noted Sonnet sent proprietary source containing a live hardcoded key in one test. That is worth carrying: a 0% in a compliance table is not the same as no data leaving.
The line the researchers draw from this is the one that generalises:
The safety boundary around the model can matter as much as the model itself.
What was targeted
.ssh/id_rsa— SSH private keys.env— environment variables- Proprietary source code
customers.csv— customer data
The list is unglamorous on purpose. These are the files a coding agent already has permission to read.
The precondition that bounds the risk
This is not an external intrusion vector, and the research is clear about it. GhostSplice requires that the developer has already connected the attacker's MCP server, and it assumes the agent can already read the files being taken.
That is a real constraint. It is also a smaller one than it sounds, because installing an MCP server is currently a two-line config change made on the strength of a README, and the ecosystem has no equivalent of package signing.
We looked in July at instruction files that run before a developer types their first prompt and at PromptLogger's findings on AI instruction files as a persistence mechanism. GhostSplice is the same category of problem with the delivery moved one layer out: the agent's tool surface rather than its file context.
No CVE identifiers had been assigned as of 10 August 2026. The disclosure followed coordinated vulnerability disclosure. OpenAI's current guidance already warns that unsafe MCP servers increase prompt-injection risk and recommends vetting integrations — which is correct, and is advice that only works if there is something to vet against.
What to take from it
- Model choice is not the control. GPT-5.4 went from 100% to 0% by changing harness, not model. Whatever Claude Code does differently is doing more work than the model's own refusals.
- Per-request filtering cannot see this. Every fragment is individually benign. A filter that scores requests in isolation will pass all of them.
- Treat MCP servers as dependencies with write access to your reasoning. Not as plugins. The tool description is untrusted input that reaches the model on every turn.
- Egress is the last honest boundary. If an agent can reach an arbitrary host, the assembled instruction has somewhere to send data. If it cannot, most of this stops being interesting.
- A 0% row is not a clean bill of health. One of the 0% models still sent source with a live key in it.
The uncomfortable structural point is that the split-instruction problem does not have an obvious model-level fix. Assembling scattered context into a coherent action is not a failure mode of a capable agent. It is the capability.
