AI Coding Assistants Tricked Into Leaking Secrets via 'Split Instruction' Attacks

A new attack technique shows how AI coding assistants can be manipulated into leaking sensitive information such as SSH keys, environment variables, source code, and customer data — even when they would normally refuse an obvious request to do so. Instead of asking the AI to do something clearly malicious in one step, attackers connect a compromised or malicious 'tool server' to the assistant and split the harmful instruction into several smaller, routine-looking steps.

Because each individual step appears harmless, the AI coding assistant doesn't recognise the overall pattern as an attack. The fragments are delivered through channels the assistant already trusts and regularly uses, allowing the theft to happen gradually and quietly, without triggering the safety checks that would normally block a single, obviously dangerous instruction.

This type of attack highlights a growing risk as businesses adopt AI-powered coding tools and connect them to third-party plugins, extensions, or servers. Even well-intentioned integrations can become a pathway for data theft if they aren't properly vetted, since the AI assistant may have broad access to code repositories, credentials, and internal systems.