Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets

A malicious tool server can trick AI coding assistants into exfiltrating SSH keys, environment secrets, source code, and customer data. The attack splits requests into fragments that each appear routine and places them in channels the assistant already uses, bypassing blunt theft refusal checks. The technique works without sending any obviously harmful instructions to the assistant.