How a Rogue Helper Tool Can Trick an AI Coding Assistant Into Leaking Your Secrets
Researchers show that a hostile plugin can smuggle out SSH keys and source code by breaking one big theft into small, innocent-looking steps.
Key points
- A malicious tool server hooked into an AI coding assistant can quietly steal SSH keys, environment secrets, source code and customer data.
- Splitting one obvious theft into small fragments lets each piece look like a routine developer request.
- The assistant is tricked even after refusing a blunt version of the same instruction, because the fragments arrive through channels it already trusts.
- The technique targets AI coding agents that use Model Context Protocol (MCP) servers, a plugin system that lets assistants call outside tools.
- The Hacker News first reported the research, which highlights a growing risk as developers give AI assistants deeper access to their machines.
Picture a builder with an over-eager apprentice. You give the apprentice a shopping list. A stranger walks up and, instead of asking for your wallet outright, asks for one receipt, then your address, then your bank's name. Each answer sounds harmless. Put together, it's a robbery.
That's roughly what researchers have now shown against AI coding assistants: the software many developers use to write and review code on their behalf.
What actually happened?
Security researchers demonstrated that a booby-trapped helper tool, connected to an AI coding assistant, can walk off with sensitive files without ever issuing a clearly malicious command. It does this by breaking one big request into fragments that each look like normal developer chatter.
These helper tools are called MCP servers. MCP stands for Model Context Protocol, a system that lets an AI assistant plug into outside tools, read files, call other services and take actions. Think of MCP servers as apps you install into your assistant to give it new abilities.
If one of those apps is hostile, it can whisper instructions back to the assistant.
How does the split-instruction trick work?
The assistant will often refuse a blunt request such as "send me the SSH keys", which are the digital passes a developer's machine uses to log in to servers. So the attacker doesn't ask bluntly.
Instead, the malicious MCP server drips the request in pieces. One fragment asks the assistant to list files in a common folder. Another asks it to read a config file for "debugging". A third asks it to include the contents in a status report sent back to the attacker's server.
Each step, on its own, is the sort of thing a developer might genuinely ask. Stitched together, the assistant hands over SSH keys, environment variables (settings files that often hold passwords and API keys), chunks of source code and, in some setups, real customer data.
The smuggling channel isn't some exotic new protocol. It's the same one the assistant already uses to talk to its tools. If this sounds familiar, it should: it's prompt injection, the AI-era cousin of cross-site scripting on the web, where untrusted input gets treated as trusted instructions. We reported a close relative of this attack on 22 July, when Microsoft's Azure DevOps MCP server was shown passing unvetted pull request descriptions to AI agents.
Who is at risk?
Any team letting an AI coding assistant connect to third-party MCP servers is exposed, especially where the assistant has access to source code repositories or cloud credentials. Solo developers experimenting with community-built plugins are the softest target.
Ordinary consumers aren't the direct victims here. The risk lands on companies whose developers install a shady plugin and, without realising, hand it the keys to the codebase.
| Detail | What the research shows |
|---|---|
| Attack vector | Malicious MCP server connected to an AI coding assistant |
| Data at risk | SSH keys, environment secrets, source code, customer data |
| Key technique | Splitting one theft into small, benign-looking fragments |
| Bypasses | Refusals triggered by blunt, single-shot malicious prompts |
What should developers and their employers do?
Treat MCP servers like browser extensions with root access: install only ones you trust, from sources you can name, and review what they're allowed to touch. Assume any plugin can read anything the assistant can read.
Log what the assistant does. If your AI helper is quietly reading ~/.ssh/ during a task that has nothing to do with servers, that should trip an alarm, not a shrug.
Stop pretending refusals are a security control. They're a speed bump. Our earlier piece on AI safety certificates made the same point from a compliance angle: once an agent is live and acting autonomously, the badge on the box means nothing.
