Breaking

'Ghostcommit' Buries Prompt Injection in Images to Fool AI Code Reviewers and Steal Secrets

July 11, 2026 at 05:05 EDT

Security
AI Agents
Software Dev & Coding

A newly disclosed proof-of-concept dubbed "Ghostcommit" hides prompt injection inside images to trick AI code reviewers and coding agents into leaking a repository's secrets (its .env file). Reported by BleepingComputer on July 11, 2026, the technique was developed by Sudipta Chattopadhyay and colleagues at the ASSET Research Group at the University of Missouri-Kansas City, who published full details and proof-of-concept code.

July 11, 2026 · ASSET Research Group

"Ghostcommit": Prompt Injection Hidden Inside Images Tricks AI Coding Agents Into Leaking Secrets

A malicious instruction buried in a PNG orders AI agents to read a repo's .env file and write out its secrets — encoded as integer tuples that slip past both text reviewers and secret scanners.

The blind spot it exploits

73%

of merged PRs reached the default branch with no meaningful human or bot review

6,480

PRs analyzed across the top 300 public repos over 90 days

311

integer tuples encoding a full .env leaked on the first try

How the attack flows

1 · Poisoned PR

Adds AGENTS.md pointing to a PNG with hidden instructions

→

2 · Review skips it

Text reviewers treat .png as an opaque blob — it merges

→

3 · Agent obeys

On a normal task it reads .env, writes it as an integer tuple

→

4 · Secrets stolen

Attacker decodes integers from the public commit

Same attack, opposite outcomes

Ten runs per configuration — behavior depends on the "harness," not just the model.

Cursor + Claude Sonnet 4.6

Leaked the full .env as 311 integer tuples on the first try

LEAKED

Antigravity / Codex CLI family

Successful leaks across multiple models

LEAKED

Antigravity + Opus

Wrote the data, then recognized the pattern and deleted it

CAUGHT SELF

Claude Code (Sonnet / Haiku / Opus)

Explicitly refused in all cases

REFUSED

The defense: actually open the images

A GitHub App running on a single 4GB GPU analyzed images directly — and detected every planted attack.

49 / 49

attacks caught in 80 real PR tests

false positives across 30 benign PRs

For now, practitioners are advised to make image review mandatory or restrict agents' file access.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.