Security researchers have uncovered a new Ghostcommit attack that targets AI coding assistants. Instead of placing malicious instructions in code, the attackers hide them inside PNG images. The technique allows malicious pull requests to pass automated code reviews before AI agents unknowingly expose sensitive repository data.
Researchers say the attack exploits a gap between AI code review tools and AI coding assistants. One system ignores image files, while another reads them as trusted project instructions.
AI Review Tools Ignore the Malicious Image
The Ghostcommit attack was created by researchers from the ASSET Research Group at the University of Missouri–Kansas City.
Their proof-of-concept demonstrates how attackers can submit a harmless-looking pull request containing a PNG image with embedded prompt injection instructions. Many automated code review tools skip image files completely. As a result, the malicious content passes inspection without raising any alerts.
The researchers have published a proof-of-concept and shared their findings with affected vendors.
Hidden PNG Tells AI to Expose Secrets
Rather than storing malicious instructions in source code, the attack hides them inside a PNG file referenced by an AGENTS.md document.
The AGENTS.md file appears to contain normal project guidance. However, it directs AI coding assistants to open the image. The PNG contains instructions telling the AI to read the repository’s .env file, convert every byte into integers, and insert those numbers into source code as what appears to be a harmless constant.
Because the stolen data is encoded as integers instead of plain text, traditional secret scanners fail to recognize the leak.
In one demonstration, an AI coding assistant generated a module containing more than 300 integers. Those values could later be decoded into the complete contents of the .env file.
The Attack Waits Until Later
The malicious pull request does not steal secrets immediately after it is merged.
Instead, the payload remains inactive until a developer later asks an AI coding assistant to perform a routine programming task. When the assistant starts, it reads the trusted AGENTS.md file. It then opens the referenced PNG and follows the hidden instructions while generating the requested code.
The developer receives the expected feature and commits the changes. Without realizing it, they also publish the encoded repository secrets. Attackers can then decode the numbers and recover the original credentials.
Coding Platforms Make the Difference
The researchers found that the success of the Ghostcommit attack depended more on the coding platform than on the underlying AI model.
Several coding tools followed the hidden instructions and leaked repository secrets across multiple AI models. Other platforms consistently refused to perform the malicious actions, even when using the same language model.
One AI assistant even generated the encoded secret before recognizing the suspicious behavior. It deleted the data before completing the task.
These results suggest that runtime protections and platform-specific safeguards are just as important as improvements to the AI models themselves.
Researchers Recommend Multiple Layers of Protection
To address the problem, the researchers developed a multimodal pull request review system that analyzes both source code and images.
The system scans for hidden characters, examines code structure, reviews project conventions with AI, and inspects attached images for prompt injection attempts.
During testing, the prototype analyzed 80 previously unseen pull requests. It detected every image-based attack except one. It also produced no false positives across 30 legitimate pull requests.
The researchers also recommend monitoring AI coding agents while they run. Unusual behavior, such as accessing credential files without a legitimate reason, could reveal an attack before sensitive information is exposed.
0 responses to “Ghostcommit Attack Uses PNG Images to Trick AI Coding Agents Into Leaking Secrets”