AI Weekly Malaysia

ASSET Research Group demonstrated 'GhostSplice,' a technique where a malicious MCP server splits a secret-exfiltration request across tool descriptions and tool results so no single fragment looks harmful, but the AI coding agent stitches them together in context and sends sensitive files like .ssh/id_rsa, .env, and customers.csv to the attacker. The same model can refuse in one coding client but comply in another, depending on the client's safety controls. The attack requires the developer to have already connected the malicious MCP server.

Why: If you connect third-party MCP servers to your AI coding agent, you should audit each server's tool descriptions and results for split instructions, and prefer clients with stronger safety guardrails—because the same model behaves differently depending on the client wrapper. Treat MCP server installation as equivalent to granting file-read and network-exfiltration access.

A plaintiff attempted to hide prompt injection instructions within a court filing, instructing any AI model reviewing the document to rule in their favor. The scheme was discovered due to unusual white spaces in the text that tipped off reviewers to hidden content.

Why: This is a real-world case of prompt injection escaping the lab and entering legal proceedings—a concrete reminder that any system where AI reviews user-submitted text is vulnerable to manipulation. If you build AI agents that ingest external documents, you need to treat all untrusted input as potentially adversarial and implement output-level safeguards, not just input filtering.

Anthropic rebranded the Claude Chrome side panel to 'Claude Cowork,' making browser sessions sync with desktop, web, and mobile apps so multi-step tasks carry across surfaces. Claude can see pages, click links, type text, and fill forms using your existing logins, targeting internal dashboards and vendor portals that lack API integrations. It's available on Max and Team plans now, rolling out to Pro over coming weeks, with an 'automatically approve' mode that lets Claude work without pausing for permission at every step.

Why: If you're evaluating browser-based AI agents for automating work in legacy systems or vendor portals that don't have APIs, this gives you a concrete option with session continuity across devices. The prompt injection risk is real and acknowledged by Anthropic itself—anyone using auto-approve mode should understand that malicious web content can redirect Claude to unintended actions before consequential steps.