GhostCommit: PNG-based prompt-injection lets AI coding agents steal .env secrets undetected

Researchers have disclosed a stealthy new supply-chain technique, GhostCommit, that can trick AI coding agents into exfiltrating developer secrets without triggering any review tools, exploiting a structural blind spot in modern development workflows where most merged pull requests receive little to no substantive review.

ASSET Research Group’s analysis of 6,480 pull requests across the 300 most active public repositories found that 73% of merged PRs had no meaningful human or bot scrutiny, a coverage gap increasingly filled by AI-driven reviewers such as Cursor Bugbot and CodeRabbit that scan diffs and comment like humans.

The initial GhostCommit proof-of-concept embedded malicious instructions directly in a convention file (AGENTS.md), telling coding agents to read and encode a repository’s .env file as ASCII codepoints; because those instructions were plain text, current AI reviewers flagged them as high-severity and blocked the merge.

GhostCommit: PNG-based prompt-injection

Attackers evolved the approach to avoid detection by splitting the payload: the convention file is stripped to an innocuous pointer to an image file, build-spec.png, purportedly containing “build provenance” information, while the real exploit, the step-by-step order to read .env byte-by-byte and encode it as an integer tuple, is hidden inside the image’s rendered text.

Text-based reviewers treat PNGs as binary blobs and therefore fail to surface the embedded instruction, and CodeRabbit’s default setup even excludes images from review entirely.

Attackers further camouflage the change with a fabricated postmortem document to pass coherence checks that might otherwise raise suspicion about an unsupported convention.

The trap activates later when a developer asks an AI coding agent for an unrelated feature: the agent follows the merged convention file to the image, extracts the hidden procedure, reads .env, and injects a 311-integer “provenance constant” into the new code.

The developer sees only the requested feature and commits it; the attacker later decodes the integer tuple published in the commit back into the repository’s secrets, bypassing conventional secret scanners that do not recognize long integer tuples as credential-shaped artifacts.

ASSET’s testing indicates the primary vulnerability is not the underlying LLM but the surrounding harness and safety scaffolding: Cursor leaked secrets when paired with Sonnet 4.6, Composer-2, and GPT-5.5; Antigravity leaked with Sonnet 4.6, Gemini 3.1 Pro, and Flash; Codex CLI with GPT-5.4 also leaked.

Antigravity running Opus wrote the secrets and then self-corrected by deleting them; and Claude Code consistently refused the attack across Sonnet, Haiku, and Opus, implying that robust safety layers can prevent exfiltration irrespective of base model capability.

To demonstrate a practical mitigation, ASSET built a lightweight multimodal GitHub app proof-of-concept that scans images alongside text and code using the small open model Gemma 4 on a 4GB GPU; in real-world tests it caught 49 of 50 GhostCommit attempts with zero false positives on benign PRs, showing that the technical fix is straightforward but under-deployed.

The disclosure underscores a pressing security implication for organizations relying on AI-assisted development: reviewers must become multimodal, pipelines should avoid blind acceptance of non-text assets, and defensive tooling needs to recognize covert encodings (for example, integer tuples or unusual provenance constants) to prevent silent exfiltration of secrets that can later be reconstructed from public commits.