A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The attack targets coding tools that connect to outside servers over the Model Context Protocol (MCP), the open standard that lets AI assistants call external tools. A malicious MCP server can put one fragment in a tool description and another in a tool result; some setups also support server-initiated sampling. The same model can refuse in one coding client and exfiltrate in another, depending on the safety controls around it. OpenAI's current guidance likewise warns that unsafe MCP servers increase prompt-injection risk and tells organizations to vet custom and third-party integrations.