Splitting a payload across two MCP channels took injection-resistant models to 100% credential exfiltration.

arXiv 2609.18217 points out MCP exposes a model to attacker-controlled text through at least three channels sharing one context window with no privilege separation: tool descriptions, tool results, and sampling messages. Across 12 models and over 15,000 trials, distributing a payload across those channels took models that resist single-channel injection up to 100% exfiltration. Every security tool they evaluated missed the fragmented payloads. Per-channel scanning cannot see this class. The check has to run over the assembled context.