GhostSplice Isn't a Jailbreak, It's a Reminder That LLMs Can't Do Access Control

Split the instruction, split the blame Here's the part that should bother you: nobody had to find a clever new exploit primitive to pull this off. They just chopped a sentence in half. That's the whole technique. And it worked up to 100% of the time on some models. If your safety story depends on the model recognizing a bad instruction in one shot, you don't have a safety story. Context: we've seen this movie before Prompt injection via untrusted tool output isn't new. Anyone who's spent time red-teaming agentic systems has known for a while that if you let a model ingest text from an external source and then act on it with privileged tools, you've built an injection vector, full stop. What GhostSplice adds isn't a new vulnerability class, it's a demonstration that current defenses are pattern-matching on the wrong granularity. Single-prompt refusal training assumes the malicious ask arrives intact. Split it across two or three innocuous-looking tool descriptions and results, and the model reassembles the intent internally without ever seeing a chunk that trips its own guardrails. MCP (Model Context Protocol) makes this worse structurally, not because MCP itself is flawed in some novel way, but because it formalizes exactly the trust relationship that makes injection dangerous: an agent pulling in tool descriptions and results from a server it doesn't fully control, then acting on that content with local file access, SSH keys, and shell execution. We built a nice clean protocol for connecting agents to tools. We didn't build a nice clean way to know if the tool is lying to you. Hype check The framing "malicious MCP servers exfiltrate secrets" is accurate but it undersells the boring, structural nature of the problem. This isn't a zero-day. It's a logic gap that was always going to be there once you combine untrusted content ingestion with tool-calling agents that have real filesystem and network access. Calling it a "technique" with a name gives it more novelty than