Security researchers disclosed a technique on 11 August that defeats refusal training in AI coding agents by splitting a malicious instruction into fragments delivered through a connected Model Context Protocol server. Average compliance across 11 models tested by API rose from 42% to 82%.
Why fragmentation works
Safety checks evaluate a message. No individual fragment is a request to steal anything — each is an innocuous field value on a tool named integrity_checker with four bland parameters. The instruction only exists once the agent has assembled the pieces, by which point the refusal step has already passed.
The per-model results are uneven
GPT-4o, Gemini 2.0 Flash and Llama 3.3 70B all moved from 0% to 100%. GPT-5.4 complied 90% of the time inside Cursor and 100% in Codex CLI, but 0% behind Claude Code — the harness mattered as much as the model. Claude Haiku 4.5 held at 0% by API yet hit 100% under a three-piece variant in Cursor. Files taken in testing included .ssh/id_rsa, .env, customers.csv and proprietary source.
What the attack requires
The threat model assumes the developer has already connected the attacker's MCP server and that the agent has file-read access. This is not remote takeover of an arbitrary agent; it is a supply-chain problem in an ecosystem where adding a server is a one-line config change.
Status
It is a research proof of concept with a public reference implementation. There is no evidence of exploitation in the wild and no CVE as of publication; coordinated disclosure is still running.
What actually reduces the blast radius
Better refusal training does not fix this. Scoping file access per tool, requiring explicit approval before an agent reads outside the working directory, and pinning which servers a project may load at all — treating connected servers as untrusted input — is what limits the damage.