Ghostcommit: PNG prompt-injection makes AI agents leak repository secrets
Researchers disclosed Ghostcommit, a proof-of-concept prompt-injection attack that hides instructions in a PNG referenced by an AGENTS.md file. Text-oriented pull-request reviewers may treat the image as an opaque binary, while a multimodal coding agent later opens it, follows the concealed instruction, reads repository data, and writes encoded secrets into source files. The ASSET Research Group published the demonstration, and BleepingComputer plus other security outlets reported the technique. Ghostcommit does not show that every coding agent is vulnerable, but it exposes a review gap when different tools inspect different modalities. Defenses need image inspection, least-privilege credentials, restricted write paths, and review of agent-generated changes before merge.
Ghostcommit is a compositional security failure: each component can appear reasonable in isolation while the combined workflow becomes unsafe. A text reviewer sees a harmless image reference, a multimodal agent sees instructions inside the image, and repository permissions let the agent turn those instructions into actions. Security reviews that examine only code diffs can miss the cross-modal path connecting untrusted content to privileged tools.
What happened
The ASSET Research Group published a proof of concept in which a pull request adds a PNG and references it from an AGENTS.md file. The visible project instructions appear ordinary, but the image contains a prompt telling a downstream coding agent to access repository secrets and encode them into source changes. The researchers reported that automated reviewers focused on text did not inspect the image content, allowing the pull request to look benign. BleepingComputer and other security outlets independently described the demonstration and its disclosure to affected vendors.
Security context
Prompt injection becomes more dangerous when an agent can read files, access credentials, and modify a repository. The attack does not need to exploit the image parser in the conventional memory-corruption sense; it exploits trust boundaries between review tools and execution agents. A policy file can direct the agent toward an untrusted artifact, and multimodal capability converts pixels into an instruction channel. Encoding stolen values inside apparently ordinary code can also evade scanners that only search for familiar secret formats.
For practitioners
Treat every pull-request artifact as untrusted input, including images, notebooks, generated files, and documentation. Agent credentials should be scoped to the minimum files and services required, with secrets withheld from review jobs whenever possible. Multimodal content should be inspected or blocked before an agent consumes it, and policy files such as AGENTS.md should not automatically authorize arbitrary linked resources. Require human approval for changes that touch workflows, credentials, build scripts, or encoded data, and compare the agent's tool trace with the resulting diff.
What to watch
Vendors may add image-aware review, prompt-injection classifiers, and provenance indicators, but attackers can move instructions across formats. The stronger long-term signal will be sandboxing: whether coding agents run with isolated filesystems, short-lived tokens, network restrictions, and explicit approval for sensitive tools. Independent reproduction across products would clarify the affected surface. Until then, Ghostcommit should be treated as a credible proof of a workflow class, not evidence that a specific vendor environment has been compromised in production.
Key Points
- 1Ghostcommit places executable prompt instructions in an image referenced by project policy so code agents may act on concealed directives automatically.
- 2Researchers reported that 73% of merged pull requests in a 300-repository sample reached the default branch without substantive human or bot review.
- 3The authors built a prototype multimodal reviewer, disclosed findings to vendors, and multiple independent outlets reported on the Ghostcommit demonstration.
Scoring Rationale
Ghostcommit demonstrates a credible cross-modal prompt-injection path from a pull-request image to repository secret exposure. Its security significance is notable because coding agents often combine untrusted repository content with powerful tools, although the disclosure is a proof of concept rather than a reported production breach.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
