'Ghostcommit' Hides Prompt Injection in Images to Fool AI Agents, Steal Secrets
Researchers have developed 'Ghostcommit,' a novel technique that embeds malicious prompt injection instructions within PNG image metadata to bypass AI code reviewers and trick coding agents into exfiltrating sensitive repository secrets.
Researchers from the ASSET Research Group have unveiled 'Ghostcommit,' a sophisticated technique designed to exploit a significant blind spot in AI-powered code review processes. The method involves embedding malicious prompt injection commands within the metadata of PNG image files. These images are then included in pull requests, often passing through automated and even human review without detection, as image files are frequently excluded from deep inspection.
The attack leverages the fact that many AI code reviewers and bots are configured to ignore or not deeply analyze image files. The malicious instructions, hidden within the image's text, instruct AI coding agents to read sensitive files, such as .env files containing API keys and other credentials. The exfiltrated data is then encoded as a list of integers and committed to the repository, appearing as innocuous code to automated secret scanners.
This technique exploits a critical gap in current development workflows. A survey of thousands of pull requests revealed that a significant majority are merged with minimal or no substantive review. 'Ghostcommit' capitalizes on this by presenting a seemingly harmless image file that contains hidden, executable instructions for AI agents. The researchers demonstrated that even explicitly stating "malicious prompt injection" within the image text, along with a clear command to read .env, did not trigger alerts from tools like CodeRabbit or Bugbot.
The actual theft of secrets occurs later, often when a developer requests a routine task from a coding agent. Upon startup, the agent reads the embedded instructions from the image file, accesses the .env file, and includes the secret data, encoded as a numerical list, within the requested module. Tools like Cursor, when driven by models like Claude Sonnet, successfully exfiltrated the entire .env file in this manner, with the encoded secrets being publicly visible in the commit history.
While hiding instructions within images for AI systems is not entirely new, 'Ghostcommit' differentiates itself by not relying on complex steganography or obfuscation within the image itself. Instead, it exploits the reviewer's failure to even open or inspect the image file. The researchers highlight that the effectiveness of the attack is more dependent on the coding tool's harness and configuration than the underlying AI model, as different tools exhibited varying responses to the same malicious payload.
To counter this threat, the ASSET Research Group has developed a multimodal pull-request defender, a GitHub app designed to close this review gap. This defender analyzes image files alongside code and convention text, combining scans for invisible characters, code structure analysis, and LLM passes over both text and images. In trials, this defender successfully blocked image-based attacks while maintaining a low false-positive rate on legitimate pull requests.
The researchers emphasize that defense requires a layered approach, including not only pre-commit checks but also runtime monitoring of AI agent behavior. Vigilance is needed to detect when an agent accesses sensitive files it has no legitimate reason to interact with, rather than solely relying on static analysis to catch malicious payloads before they are committed.