Ghostcommit hides secret-stealing instructions inside images to slip past AI reviewers

Researchers at the ASSET Research Group demonstrated Ghostcommit, an attack that hides malicious instructions inside a PNG image so AI code reviewers miss them entirely. A harmless-looking conventions file points the coding agent to the image, whose rendered text tells the agent to read the repository's .env file and encode its secrets as a list of numbers written into the code. Because tools like CodeRabbit and Bugbot skip image files by default, the pull request passes review clean; the trap springs later when a developer asks the agent for an unrelated task. The outcome depended on the tool wrapping the model: some agents leaked secrets, while Claude Code refused.

Check

Review how your AI code reviewers and coding agents handle images and convention files like AGENTS.md, and check whether reviewers inspect image contents rather than skipping them as opaque binary files.

Affected

Teams using AI code reviewers that skip images and coding agents that auto-follow repository convention files; a merged pull request can later drive an agent to read .env and leak its secrets.

Fix

Configure AI reviewers to inspect image contents, treat convention files and repo content as untrusted input, keep secrets out of agents' reach, and require human review before agents read sensitive files.