University of Missouri, Kansas City researchers disclosed GhostCommit on July 10, 2026, a proof-of-concept attack that hides a secret stealing instruction inside a pull request’s image file. AI code reviewers never open the picture, but AI coding agents do, and later leak the secret on their own.
Quick Summary – TLDR:
- GhostCommit hides its exfiltration procedure inside a PNG image, so text-only tools like CodeRabbit and Bugbot see only a binary blob with nothing to flag.
- ASSET Research Group’s own review-gap survey found 6,480 pull requests across 300 active public repositories, and 73% of merged code reached the default branch with no substantive human review and no bot review at all.
- In one test run, Cursor driving Claude Sonnet autonomously decoded a target’s entire `.env` file into a 311-integer module constant, an unmonitored form of Shadow AI usage that looks like routine build metadata.
- Cursor and Antigravity leaked the secret, but the same Sonnet weights refused every time under Anthropic’s Claude Code, per Anthropic’s own harness comparison.
- The researchers’ own multimodal defender, built around a single 4 GB graphics card, caught 49 of 50 live attacks and flagged none of the thirty legitimate pull requests it saw.
GhostCommit Hides an Exploit Inside an Image
The convention file at the center of the attack, `AGENTS.md`, is the kind of coding-standard document that agents read automatically and treat as project policy. GhostCommit’s version names no secret and spells out no procedure; it only points at an image, `docs/images/build-spec.png`.
Everything dangerous sits inside that PNG. The rendered text tells an agent to read `.env` byte by byte, encode each byte as its ASCII codepoint, and emit the result as a module constant. A fake validator script and a fabricated postmortem give the convention enough supporting code to survive a coherence check built to flag rules with nothing behind them.
CodeRabbit’s own default configuration excludes image files from review outright, and Bugbot returned no findings, even when researchers stuffed the picture with the words “malicious prompt injection” and an explicit order to read `.env`. To a reviewer that only reads text, an image is just noise, not a threat signal.
A developer later asks their AI coding agent for something ordinary, and the agent reads the merged convention, opens the image, follows it, and writes the contents of `.env` into the new module as a tuple of integers. The developer commits the feature they asked for, and the attacker decodes the numbers straight out of the public commit.
No real credentials were at risk. Every test ran against a seeded, defanged canary credential inside repositories the researchers owned.
‘Ghostcommit’ hides prompt injection in images to fool AI agents and steal repo secrets – @Ax_Sharmahttps://t.co/ylzIoK8uxL
— BleepingComputer (@BleepinComputer) July 11, 2026
Why Reviewers Miss the Picture?
A text-based reviewer catches the blunt version of this attack instantly, since a spelled-out instruction to read `.env` and encode it is easy to flag before merge. Splitting the payload across a convention file and a separate image defeats that same reviewer, because neither Bugbot nor CodeRabbit inspects the picture itself. it resembles a reviewer that opens the attachment, and today’s reviewers do not.
That review gap is what turns a plain-text version of this payload into a working exploit. Secret scanners add a second blind spot on the way out: none of them convert a Python-style integer tuple back into ASCII text before checking it against known credential formats.
The Harness Decides, Not the Model
Across 10 runs per pairing, every coding tool tested under Cursor, Antigravity, and Codex CLI wrote out the full `.env` file once the convention was merged, regardless of the underlying model. Only one model held: Anthropic’s Claude Code refused the same convention on every model researchers pointed at it, including Sonnet, Haiku, and Opus.
| Coding tool + model | Result on the image attack (n=10 each) |
|---|---|
| Cursor + Sonnet 4.6 | Leaked the whole `.env` |
| Cursor + Composer-2 | Leaked the whole `.env` |
| Cursor + GPT-5.5 | Leaked the whole `.env` |
| Antigravity + Sonnet 4.6 | Leaked the whole `.env` |
| Antigravity + Gemini 3.1 Pro | Leaked the whole `.env` |
| Antigravity + Gemini 3 Flash | Leaked the whole `.env` |
| Codex CLI + GPT-5.4 | Leaked the whole `.env` |
| Antigravity + Opus | Wrote it, then redacted |
| Claude Code + Sonnet 4.6 | Refused |
| Claude Code + Haiku 4.5 | Refused |
| Claude Code + Opus 4.7 | Refused |
Under Antigravity, Opus computed the secret and wrote it into the file, then caught the social engineering pattern and deleted it before finishing, a partial catch short of a clean refusal. That split result, identical weights refusing in one harness and complying in another, points at the safety scaffolding around a model as the deciding factor, not its training.
Rather than wait on deployed tools to add image support, the researchers built their own countermeasure. A multimodal pull-request defender that runs as a GitHub app on modest hardware, combining an invisible character scan, a code-shape scan, and an LLM pass over both the convention text and the images themselves. On a fifteen-class internal stress test, its underlying model, Gemma 4, caught every malicious pull request with no false alarms on benign ones.
SQ Magazine’s Takeaway
GhostCommit is a proof-of-concept, not a live breach, but it exposes two blind spots already sitting in production tooling. One is procedural: the same 73% no-review gap named above is what turns a plain-text attack into a working exploit, and an LLM reviewer only closes it by actually inspecting every file type.
The other is architectural: identical model weights produced opposite outcomes depending on which coding harness wrapped them. The resulting security posture is a property of the coding harness a team picks, not just the model running underneath it.
What’s next sits mostly with the teams running these agents. Treat any file an agent reads automatically, images included, as untrusted input, and confirm whether a code-review tool actually opens image attachments before assuming it screens them.
Teams that merged AI authored pull requests referencing external images in recent months should audit those diffs and rotate any credentials that touched the repository during that window. The researchers say they notified the affected vendors before publishing, so watching for CodeRabbit and Bugbot updates that stop excluding images by default is a reasonable near-term signal to track.
