AI Weekly Malaysia

ASSET Research Group demonstrated 'GhostSplice,' a technique where a malicious MCP server splits a secret-exfiltration request across tool descriptions and tool results so no single fragment looks harmful, but the AI coding agent stitches them together in context and sends sensitive files like .ssh/id_rsa, .env, and customers.csv to the attacker. The same model can refuse in one coding client but comply in another, depending on the client's safety controls. The attack requires the developer to have already connected the malicious MCP server.

Why: If you connect third-party MCP servers to your AI coding agent, you should audit each server's tool descriptions and results for split instructions, and prefer clients with stronger safety guardrails—because the same model behaves differently depending on the client wrapper. Treat MCP server installation as equivalent to granting file-read and network-exfiltration access.

Cloudflare announced new Cloudflare One capabilities to detect and control MCP (Model Context Protocol) traffic on corporate networks. The core problem: employees can connect AI agents (Claude Code, Codex, Cursor, VS Code) to arbitrary MCP servers with a single line of config, and the resulting HTTPS traffic has no distinguishing hostname or path pattern, making 'shadow MCP' usage hard to spot. Cloudflare Gateway now uses protocol signals to identify this traffic and enforce routing through approved MCP Server Portals.

Why: If you are shipping or using AI agents that connect to MCP servers, your existing permission models were designed for humans who pause on unexpected results and act at human speed. Agents act non-deterministically and can repeat a bad tool call thousands of times before anyone notices. You should decide now whether your team needs network-level visibility into which MCP servers agents are calling, especially if employees can self-configure connections without approval.

HR startup Rippling is counter-suing MCP gateway startup Runlayer for patent infringement, after Runlayer sued Rippling last month for breach of contract and allegedly stealing its product ideas. Rippling spent nearly a year trialing Runlayer's MCP product without a paid contract, then built its own competing MCP server—prompting a Rippling employee to reportedly warn Runlayer's founder that Rippling was building a 'copy' of its product.

Why: If you're a small startup selling to large enterprises, this is a cautionary tale about trial-then-copy risk: Runlayer gave Rippling extended access to its MCP gateway product during a nearly year-long trial with no paid contract, and the larger company then shipped a competing product. Founders should insist on paid pilots, IP protections, and time-boxed trials before granting deep product access to potential enterprise customers—especially in the MCP/AI agent tooling space where building a wrapper is fast.