AI Security Briefing

What it is

Ghostcommit — a proof-of-concept from UMKC's ASSET Research Group (associate professor Sudipta Chattopadhyay and researcher Murali Ediga), published on GitHub and disclosed to affected vendors. It exfiltrates a repo's .env secrets by hiding readable prompt-injection text inside a PNG that AI code reviewers never open.

How it works

An AGENTS.md convention file — which agents read at startup and treat as project policy — reads like ordinary build hygiene and names no secret. It just points to an image (docs/images/build-spec.png). The exfiltration instructions live as plain text rendered inside that PNG: read .env byte by byte, encode each byte as an integer, emit the result as a module constant, and verify the decoded numbers match the real file before commit. Reviewers see the image as a binary blob and skip it.

The payload sits dormant until, in an unrelated later session, a developer asks the agent for something routine (e.g., a token-tracking module). The agent follows the pointer, opens .env, and writes the requested module with a "provenance" integer constant near the top. The developer commits the feature they asked for; the attacker decodes the numbers from the public commit. Secret scanners never convert a Python integer tuple back to ASCII, so they miss it.

Preconditions / Affected

• A merged AGENTS.md-style convention file referencing an attacker-supplied image.
• A coding agent that reads conventions and follows image pointers. Which harness matters more than which model: Cursor and Antigravity leaked under Sonnet, Gemini, and GPT-5.5. Claude Code refused under every model tested, narrating explicit refusals with the same Sonnet weights. Under Antigravity, Opus wrote the secret then recognized the pattern and deleted it.
• Reviewers with image review disabled — CodeRabbit's default config excludes image files outright; Bugbot returned no findings even when the PNG contained the literal words "malicious prompt injection." A fake 50-line "provenance validator" plus a fabricated postmortem defeated the reviewers' coherence check for conventions with no backing code.

Context on exposure: a survey of 6,480 PRs across the 300 most active public repos over 90 days found 73% reached the default branch with no substantive human review and no bot review.

What to do

• The researchers released a multimodal PR defender as a GitHub app running on a single 4 GB GPU. It combines an invisible-character scan, a committed-code shape scan, an LLM pass over convention text, and — critically — an LLM pass over the images. In a live trial against 80 unseen PRs, only one attack got past it (all image-based variants caught), with zero false alarms on 30 legitimate PRs.
• Add runtime monitoring: watch what an agent actually does when it reads a credentials file it had no reason to touch, rather than relying on catching the payload pre-merge.

Caveats

This is a proof-of-concept, not observed in-the-wild exploitation. The "harness decides" finding rests on ten runs per tool; one attack still bypassed the researchers' own defender.