Researchers have built a pull request that steals a repository's secrets by hiding the malicious instruction inside a PNG that AI code reviewers never open.
The reviewer waves the change through. Later, a coding agent reads the picture, opens the repo's .env, and writes every key into the source as a harmless-looking list of numbers.
How 'Ghostcommit' works
The attack is joint work from the University of Missouri-Kansas City's ASSET Research Group, by associate professor Sudipta Chattopadhyay and researcher Murali Ediga, who shared it with BleepingComputer.
The group published a proof-of-concept on GitHub this week and says it has disclosed the findings to the affected vendors.
The researchers frame the attack against a review gap that's already wide: a survey of 6,480 pull requests across the 300 most active public repositories over the past 90 days found 73% of merged PRs reached the default branch with no substantive human review and no bot review at all.
The trick is that the malicious instruction isn't text a reviewer can catch. It's a picture.
An AGENTS.md file, the kind of coding-convention file agents read automatically and treat as project policy, reads like ordinary build hygiene and names no secret.
It just points to an image, docs/images/build-spec.png. The exploit lives in text rendered inside that PNG: read .env byte by byte, encode each byte as an integer, emit the result as a module constant, and verify the decoded numbers match the real file before commit.
To a text-based reviewer, an image is a binary blob.
CodeRabbit ships with a default config that excludes image files from review outright. Bugbot returned no findings.
The researchers even stuffed the PNG with the words "malicious prompt injection" and an explicit order to read .env, and it still passed clean.
A fake 50-line "provenance validator" and a fabricated incident postmortem gave the convention enough supporting code to defeat the reviewers' last defence, a coherence check that flags conventions with no code behind them.
The theft happens later.
The payload sits dormant until, in an unrelated session, a developer asks the coding agent for something routine, such as a token-tracking module.
The agent reads the merged AGENTS.md at startup, follows the pointer to the image, opens .env, and writes the requested module with a "provenance" constant near the top.
In one end-to-end run, Cursor driving Claude Sonnet did this on the first try, and the constant it emitted ran to 311 integers that decode byte-for-byte to the entire .env.
The developer sees the feature they asked for and commits, and the attacker decodes the numbers from the public commit. Secret scanners never notice, because none of them turn a Python integer tuple back into ASCII to check it.
An old trick, a new blind spot
Hiding instructions inside images for an AI system to act on isn't new.
In 2025, Trail of Bits researchers Kikimora Morozova and Suha Sabi Hussain demonstrated a cleverer version, i.e. images that look clean at full resolution but resolve into readable prompt-injection text once an AI system's own downscaling pipeline resamples them, a technique that fooled tools like Gemini CLI.
More recently, macOS malware dubbed Gaslight embedded fake system-failure messages inside its binary, aimed at a different AI reader, trying to talk AI-assisted malware analysis tools into aborting their own analysis.
Earlier this year, my research team at Manifold Security showed an AI code reviewer was fooled by a spoofed git identity into merging a malicious pull request, no image required.
Ghostcommit's image carries no such disguise. The exfiltration instructions sit in plain, readable text inside the PNG.
What makes it work isn't a hidden signal, but rather a blind spot: the reviewer never opens the file at all.
The tooling decides, not the model
The sharpest finding is about where the danger actually lives.
Across ten runs each, the coding tool mattered more than the model.
Cursor and the Antigravity coding tool both followed the image and leaked the .env under Sonnet, Gemini, and GPT-5.5, among others.
Anthropic's Claude Code, running the same Sonnet weights, read the same convention and refused, narrating an explicit refusal, and it refused under every model the researchers tested.
Under Antigravity, Opus wrote the secret out, then recognised the social-engineering pattern and deleted it before finishing. Same model, opposite outcomes, decided by the harness wrapped around it.
That points at defence in depth rather than a single fix.
The researchers built one layer themselves:
"Since the blind spot is structural, we built the reviewer that closes it: a multimodal pull-request defender, deployed as a GitHub app that runs on a single 4 GB graphics card," write the researchers.
"It combines a scan for invisible characters, a scan of the committed code's shape, an LLM pass over the convention text, and, critically, an LLM pass over the images."
In a live trial against 80 pull requests it hadn't seen before, only one attack got past it, every image-based variant included, and none of the 30 legitimate PRs triggered a false alarm.
As the researchers put it, "it resembles a reviewer that opens the attachment, and today's reviewers do not."
The other layer is runtime. Watching what an agent actually does when it reads a credentials file it had no reason to touch, rather than trying to catch the payload before it ships.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now