Ghostcommit Hides Instructions in PNGs to Trick AI Agents Into Exposing Repository Secrets
Summary
Researchers demonstrated Ghostcommit, a pull-request attack that hides instructions in a PNG and can lead coding agents to encode .env secrets in committed code. They also tested a multimodal reviewer that blocked nearly all attacks in an 80-PR trial.
Key points
- Ghostcommit places instructions in a PNG referenced by an AGENTS.md file; AI reviewers that skip images may miss the malicious instructions.
- In a later coding session, an agent may read .env and encode its contents as integers in generated code, allowing secrets to be recovered from a public commit.
- In one reported end-to-end test, Cursor with Claude Sonnet emitted 311 integers that decoded to the entire .env file.
- Across the researchers’ tests, outcomes varied by coding tool: Cursor and Antigravity followed the image instructions, while Claude Code refused under the tested models.
- A multimodal pull-request defender tested on 80 unseen pull requests let one attack through and raised no false alarms on 30 legitimate pull requests.
- The researchers argue for defense in depth, including image-aware pull-request review and monitoring agents for unnecessary access to credential files.
Article Details
- Attack Vectors
- A pull request embeds readable malicious instructions in a PNG referenced by AGENTS.md, bypassing text-based review when reviewers do not inspect images.
- After the malicious AGENTS.md is merged, a coding agent follows the image instructions, reads the repository's .env file, and encodes its contents as integers in generated source code.
- The secret values are exposed when a developer commits the generated code to a public repository, where the attacker can decode them.
- Defensive Notes
- Inspect images as well as text and code in pull requests; the researchers' multimodal defender combines image and convention analysis with scans for invisible characters and suspicious code structure.
- Monitor coding-agent behavior at runtime, particularly unexpected access to credentials files such as .env.
- Do not rely solely on secret scanners that may not decode integer sequences back into text.
MITRE ATT&CK
People
Kikimora MorozovaTrail of Bits researcher who demonstrated images that reveal prompt-injection text after an AI system's image-resampling pipeline.Murali EdigaUniversity of Missouri-Kansas City's ASSET Research Group researcher and co-researcher on the Ghostcommit demonstration.Sudipta ChattopadhyayUniversity of Missouri-Kansas City's ASSET Research Group associate professor and co-researcher on the Ghostcommit demonstration.Suha Sabi HussainTrail of Bits researcher who demonstrated images that reveal prompt-injection text after an AI system's image-resampling pipeline.
Malware
Vendors
Products
AntigravityCursor and the Antigravity coding tool both followed the image and leaked the .env under Sonnet, Gemini, and GPT-5.5, among others.BugbotThe attack exploited review blind spots in tools like Cursor and Bugbot, while the researchers also released a multimodal defense to inspect images, conventions, and agent behavior.Claude CodeAnthropic’s Claude Code, running the same Sonnet weights, read the same convention and refused, narrating an explicit refusal, and it refused under every model the researchers tested.Claude SonnetIn one end-to-end run, Cursor driving Claude Sonnet did this on the first try, and the constant it emitted ran to 311 integers that decode byte-for-byte to the entire .env.CodeRabbit#GhostcommitCursorThe attack exploited review blind spots in tools like Cursor and Bugbot, while the researchers also released a multimodal defense to inspect images, conventions, and agent behavior.Geminiimages that look clean at full resolution but resolve into readable prompt-injection text once an AI system’s own downscaling pipeline resamples them, a technique that fooled tools like Gemini CLI.Gemini CLIimages that look clean at full resolution but resolve into readable prompt-injection text once an AI system’s own downscaling pipeline resamples them, a technique that fooled tools like Gemini CLI.GitHubThe group published a proof-of-concept on GitHub this week and says it has disclosed the findings to the affected vendors.GPT-5.5Cursor and the Antigravity coding tool both followed the image and leaked the .env under Sonnet, Gemini, and GPT-5.5, among others.