Breaking

Researchers Unveil 'Ghostcommit' Attack That Hides Malicious Prompts in Images to Hijack AI Coding Agents

July 11, 2026 at 12:46 EDT

Security
AI Agents
Software Dev & Coding

Security researchers have disclosed a new supply-chain attack called "Ghostcommit" that smuggles prompt-injection instructions inside PNG images, slipping past AI code reviewers and tricking coding agents into leaking a repository's secrets. The technique, published on July 11, 2026, as a proof-of-concept by the ASSET Research Group at the University of Missouri-Kansas City, exposes a blind spot in how automated review tools and coding assistants handle non-text files.

July 11, 2026 · ASSET Research Group

"Ghostcommit": Prompt Injection Hidden Inside a PNG

A proof-of-concept smuggles malicious instructions inside an image file that AI code reviewers ignore as binary — then, after merge, a coding agent reads it and quietly leaks the repository's .env secrets.

73%

of merged PRs reached the default branch with no meaningful human or bot review

311

integers emitted — the full set of .env secrets encoded and exfiltrated

traces left at review time — exfiltration is delayed until after the merge

The attack chain

1 · Hide payload

Instructions rendered inside build-spec.png, referenced via AGENTS.md

→

2 · Pass review

Reviewers treat images as opaque blobs and skip them (e.g. !**/*.png)

→

3 · Leak secrets

Agent later reads the image, reads .env and plants it as a fake canary tuple

Outcome depends on the agent, not the pipeline

Same task, same underlying model — three very different results.

FULL LEAK

Cursor + Claude Sonnet

Ran the whole chain

SELF-
DELETED

Antigravity + Opus

Produced then removed it

REFUSED

Claude Code

Blocked the task

The defense that closes the gap

A multimodal review app — running on a single 4GB GPU — must inspect the same modalities the agents can read.

15 / 15

attack classes caught on benchmark

49 / 50

attacks detected in an 80-PR real-world test

false positives across 30 benign PRs

Takeaway: AI code reviewers don't inspect images — treat them as productivity tools, not security controls. Until review systems read the same files agents can, images stay an unguarded channel for hidden instructions.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.