Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-12 · source-backed
ASSET Research Group disclosed this on August 11: a malicious MCP server splits an exfiltration request into fragments that are each individually innocuous. A bland integrity_checker tool with fields named alpha through delta, then a later project-scan result supplying the mapping to .ssh/id_rsa, proprietary source, customers.csv, .env. Reframed as form-filling instead of theft, agents that refused the direct ask complied. Codex CLI driving GPT-5.4 chained scan_project → deep_scan → integrity_checker with raw file contents, unprompted (ASSET). PoC at github.com/asset-group/ghostsplice, no CVEs yet, disclosure ongoing. The attack defeats per-fragment inspection by design, so scanning individual servers cannot catch it. The defense every serious MCP analysis now converges on: treat tool results strictly as data, block unchecked flow from one tool's output into the next tool's arguments, keep a human in the deny path (The Hacker News). That's a taint rule at the harness level, not an allowlist of trusted servers.
Each link below shares sources, entities, or timing with this story.
Codex CLI uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Codex CLI uses MCP); both cover GPT, MCP, The Hacker News; reported by the same outlet (thehackernews.com).
Codex CLI partners with Claude / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Codex CLI partners with Claude); both cover August, Codex CLI, MCP; reported by the same outlet (thehackernews.com).
Copilot uses GPT / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Copilot uses GPT); both cover August, CVEs, MCP; overlapping topics (august, server).
OpenAI released Codex CLI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenAI released Codex CLI); both cover August, Codex CLI, MCP; overlapping topics (agent, server).
Codex CLI uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Codex CLI uses MCP); both cover August, Codex CLI, MCP; overlapping topics (agent, august).
Linked by a graph relationship (Codex CLI uses MCP); both cover August, Codex CLI, MCP; overlapping topics (agent, august).
Codex CLI partners with Claude / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Codex CLI partners with Claude); both cover August, MCP; overlapping topics (agent, server, tool).
Codex CLI uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Codex CLI uses MCP); both cover CVEs, MCP; reported by the same outlet (thehackernews.com).