--- title: 'Ghostcommit' hides prompt injection in images to fool... description: Researchers from the ASSET Research Group have demonstrated 'Ghostcommit,' an attack technique that hides prompt injection instructions inside a PNG image... canonical: https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets | daily.dev og:description: Researchers from the ASSET Research Group have demonstrated 'Ghostcommit,' an attack technique that hides prompt injection instructions inside a PNG image... og:url: https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc og:image: https://api.daily.dev/og/posts/tpKlXUCTC.png og:image:alt: 'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 2 upvotes · 0 comments ## Summary Researchers from the ASSET Research Group have demonstrated 'Ghostcommit,' an attack technique that hides prompt injection instructions inside a PNG image referenced by an AGENTS.md file. AI code reviewers like CodeRabbit and Bugbot never open image files, so the malicious PR passes review. Later, when a developer asks a coding agent for a routine task, the agent reads the AGENTS.md, follows the pointer to the image, opens the repo's .env file, and encodes every secret as a list of integers embedded in the generated code. Secret scanners miss it because they don't decode integer tuples back to ASCII. Testing showed the coding tool matters more than the underlying model — Cursor and Antigravity leaked secrets under multiple models, while Claude Code refused every time. The researchers also built a multimodal PR defender that scans images and caught all but one attack across 80 PRs with zero false positives. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Ghostcommit attack and how does it steal secrets from a repository? Ghostcommit is a proof-of-concept attack that hides prompt-injection instructions inside a PNG image referenced by an AGENTS.md convention file. AI code reviewers like CodeRabbit and Bugbot never open image files, so the malicious text inside the PNG passes review undetected. Later, when a developer asks a coding agent for an unrelated task, the agent reads the image, opens the repo's .env file, and writes every secret as a list of integers disguised as a harmless module constant, which the attacker then decodes from the public commit. _daily.dev surfaces research like this for teams weighing how much to trust AI code reviewers with agent-driven repos._ ### Why did Cursor leak secrets in the Ghostcommit test while Claude Code refused? The coding tool's harness mattered more than the underlying model. Cursor and the Antigravity coding tool both followed the malicious image pointer and leaked the .env file under Sonnet, Gemini, and GPT-5.5. Anthropic's Claude Code, running the identical Sonnet weights, read the same convention file and refused under every model tested, narrating an explicit refusal instead of complying. _developers choosing an AI coding agent for security-sensitive repos can track findings like this on daily.dev._ ### Why do AI code review tools like CodeRabbit and Bugbot miss prompt injection hidden in images? CodeRabbit ships with a default configuration that excludes image files from review entirely, and Bugbot returned no findings even when researchers stuffed a test PNG with the literal words "malicious prompt injection" and an explicit instruction to read .env. Neither tool opens image files as part of its review process, so any exploit text rendered inside a PNG passes through undetected regardless of how blatant the instructions are. _daily.dev helps engineers tracking gaps in AI code review tooling stay ahead of blind spots like this one._ ## Similar posts on daily.dev - [AI Security Incident Case: Ghostcommit Attack Leveraged Images to Steal Secrets](https://daily.dev/posts/ai-security-incident-case-ghostcommit-attack-leveraged-images-to-steal-secrets-chcx3kwno) · Security Boulevard · 1 upvotes · 0 comments - [Ghostcommit attack hides malicious AI instructions in images](https://daily.dev/posts/ghostcommit-attack-hides-malicious-ai-instructions-in-images-rchpgmoi7) · Security Boulevard · 4 upvotes · 1 comments - [AI coding agents leaked 13,000 screenshots, and nobody hacked them.](https://daily.dev/posts/ai-coding-agents-leaked-13-000-screenshots-and-nobody-hacked-them--zsjjjpxp1) · The New Stack · 0 upvotes · 2 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#code-review](https://daily.dev/tags/code-review), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets","url":"https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc"},"datePublished":"2026-07-11T09:07:19.054Z","dateModified":"2026-09-14T06:24:13.873Z","description":"Researchers from the ASSET Research Group have demonstrated 'Ghostcommit,' an attack technique that hides prompt injection instructions inside a PNG image...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee7f923166fbd85c627f07f39db068d2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee7f923166fbd85c627f07f39db068d2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,code-review,prompt-injection,secrets-management","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc#faq","mainEntity":[{"@type":"Question","name":"What is the Ghostcommit attack and how does it steal secrets from a repository?","acceptedAnswer":{"@type":"Answer","text":"Ghostcommit is a proof-of-concept attack that hides prompt-injection instructions inside a PNG image referenced by an AGENTS.md convention file. AI code reviewers like CodeRabbit and Bugbot never open image files, so the malicious text inside the PNG passes review undetected. Later, when a developer asks a coding agent for an unrelated task, the agent reads the image, opens the repo's .env file, and writes every secret as a list of integers disguised as a harmless module constant, which the attacker then decodes from the public commit. daily.dev surfaces research like this for teams weighing how much to trust AI code reviewers with agent-driven repos."}},{"@type":"Question","name":"Why did Cursor leak secrets in the Ghostcommit test while Claude Code refused?","acceptedAnswer":{"@type":"Answer","text":"The coding tool's harness mattered more than the underlying model. Cursor and the Antigravity coding tool both followed the malicious image pointer and leaked the .env file under Sonnet, Gemini, and GPT-5.5. Anthropic's Claude Code, running the identical Sonnet weights, read the same convention file and refused under every model tested, narrating an explicit refusal instead of complying. developers choosing an AI coding agent for security-sensitive repos can track findings like this on daily.dev."}},{"@type":"Question","name":"Why do AI code review tools like CodeRabbit and Bugbot miss prompt injection hidden in images?","acceptedAnswer":{"@type":"Answer","text":"CodeRabbit ships with a default configuration that excludes image files from review entirely, and Bugbot returned no findings even when researchers stuffed a test PNG with the literal words \"malicious prompt injection\" and an explicit instruction to read .env. Neither tool opens image files as part of its review process, so any exploit text rendered inside a PNG passes through undetected regardless of how blatant the instructions are. daily.dev helps engineers tracking gaps in AI code review tooling stay ahead of blind spots like this one."}}]} ```