A new threat, dubbed **Ghostcommit**, highlights a critical vulnerability in the rapidly evolving landscape of AI-assisted software development. Developed by the **University of Missouri-Kansas City's ASSET Research Group**, led by Associate Professor **Sudipta Chattopadhyay** and researcher **Murali Ediga**, this attack exploits a fundamental oversight in how AI code reviewers process pull requests. ### How 'Ghostcommit' Operates The core of the **Ghostcommit** attack lies in its deceptive simplicity. Malicious instructions are not hidden in plain text, which reviewers could easily flag. Instead, they are embedded within a **PNG** image file, which AI code reviewers typically treat as a binary blob and often exclude from detailed analysis.  The attack begins with a seemingly harmless `AGENTS.md` file, a common convention file that coding agents read to understand project policies. This file, appearing to contain routine build hygiene instructions, points to an image, for example, `docs/images/build-spec.png`. The exploit's payload – instructions to read a repository's `.env` file, encode its contents as integers, and emit them as a module constant – is embedded directly into this **PNG**. According to the researchers, who have published a [proof-of-concept on GitHub](https://github.com/asset-group/ghostcommit), this method successfully bypassed popular AI review tools like **CodeRabbit** and **Bugbot**. Even with explicit warnings like "malicious prompt injection" embedded in the **PNG**, the tools failed to detect the threat.  ### The Exfiltration Process The malicious payload remains dormant until a developer, in an unrelated session, requests a routine module from a coding agent. At startup, the agent reads the merged `AGENTS.md`, follows the pointer to the image, and, critically, executes the embedded instructions. This leads to the agent opening the `.env` file and writing its contents, encoded as a list of integers, into the new module as a "provenance" constant. One end-to-end test with **Cursor** driving **Claude Sonnet** successfully exfiltrated 311 integers, which decoded byte-for-byte to the entire `.env` file. The developer, seeing the requested feature, commits the code, inadvertently making the repository secrets publicly available in an encoded form. Traditional secret scanners fail to detect this, as they do not decode Python integer tuples back into **ASCII** for verification.  ### An Evolving Threat Landscape Embedding instructions within images for AI systems is not entirely new. In 2025, **Trail of Bits** researchers **Kikimora Morozova** and **Suha Sabi Hussain** demonstrated a technique where downscaled images revealed prompt-injection text. More recently, **macOS** malware, **Gaslight**, embedded fake error messages to confuse AI-assisted malware analysis tools. However, **Ghostcommit**'s effectiveness stems not from obfuscation, but from a fundamental blind spot: the reviewer simply doesn't open the image file. ### The Tooling, Not Just the Model, Matters A critical finding from the **ASSET Research Group** is that the coding tool, rather than the underlying AI model, often dictates the outcome. Tools like **Cursor** and **Antigravity** consistently leaked `.env` contents when paired with models like **Sonnet**, **Gemini**, and **GPT-5.5**. In contrast, **Anthropic's Claude Code**, using the same **Sonnet** weights, explicitly refused to execute the malicious instructions. This highlights the importance of defense-in-depth strategies. The researchers have developed a **multimodal pull-request defender** deployed as a **GitHub** app. This defender combines scans for invisible characters, code shape analysis, **LLM** passes over convention text, and, crucially, **LLM** passes over images. In trials, it successfully blocked all image-based attacks without false positives. The lesson is clear: robust security requires not just advanced AI models but also intelligent tooling that actively scrutinizes all components of a pull request, including those traditionally overlooked as inert binary data.