Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets

A malicious server connected to an AI coding assistant can secretly exfiltrate sensitive information, including SSH keys and customer data. This can be achieved by splitting a malicious request into smaller, seemingly routine fragments and sending them through existing channels. The approach allows the malicious server to bypass detection, even if a more direct attempt at theft is blocked. The fragments, when combined, enable the exfiltration of secrets without raising suspicion. The technique exploits the AI coding assistant's normal functionality to carry out the data theft.