Security researchers have demonstrated a new way to weaponize AI coding assistants: hide the attack instructions inside an image, commit it to a project, and wait for an AI agent to read it and quietly hand over the project's secrets. The technique, named Ghostcommit, was disclosed on July 11, 2026 by Sudipta Chattopadhyay and Murali Ediga of the ASSET Research Group at the University of Missouri-Kansas City. In their words, "Nobody looks at images. That is the core of the entire attack."
The payoff for an attacker is the crown jewels of most software projects: the .env file, which typically holds API keys, database connection strings, and cloud service tokens. What makes Ghostcommit notable is that it does not rely on any software flaw or CVE. It abuses a structural blind spot in how modern, AI-assisted development actually works.
Why the gap exists
The researchers reviewed 6,480 pull requests across 300 of the most active public repositories over 90 days and found that 73 percent of merged changes reached the main branch without substantive human or bot review. AI review tools such as Cursor Bugbot and CodeRabbit increasingly fill that gap, but they read code and text and, by default, do not look at images. The result is an asymmetry an attacker can exploit: the AI model can read an image, but the review tool never opens it.
How the attack works
Ghostcommit runs in two stages. First, delivery: the attacker opens a pull request that adds a coding-convention file named AGENTS.md. That file points to an image, and the malicious instructions live inside the image rather than in any text. To a human, the image is just a binary blob in the diff, so reviewers rarely open it; the AI review bots skip it entirely. The pull request merges, leaving the trap dormant in the repository.
Second, triggering: some time later a developer asks a coding AI agent to write a routine module. The agent reads the merged convention file, opens the referenced image, and follows the instructions inside. It writes the contents of the .env file into a new file as a tuple of integers. Decoded byte by byte, those integers reveal every secret in the file. Because secret-scanning tools do not reverse an integer tuple back into text, they stay silent throughout. The attacker simply reads the tuple from the public commit and decodes it.
The tool matters more than the model
One of the study's sharpest findings is that success depended on the development tool, not the underlying model. Cursor and Antigravity leaked secrets across multiple models, while Claude Code refused to carry out the same instructions under the exact same model weights. The researchers conclude that the security boundaries designed into the toolchain matter more than model alignment alone. Traditional defenses, human review, AI text review, and secret scanning, all failed against image-embedded instructions combined with integer encoding.
Ghostcommit fits a growing pattern of prompt-injection attacks against AI developer tooling. It follows earlier work such as the EchoLeak zero-click exfiltration of Microsoft 365 Copilot and a zero-click compromise of the Cursor IDE through poisoned MCP configurations, and it maps directly to the prompt-injection risk that tops the OWASP Top 10 for LLM applications.
What you should do
Treat images and other binary assets in pull requests as reviewable content, not inert files, and require a human to open anything an AI agent might later parse. Configure AI review tools to inspect images where possible, and do not let AI agents follow convention files such as AGENTS.md without scrutiny. Tightly scope access to .env secrets, rotate exposed credentials, and monitor commits for encoded blobs that secret scanners would miss. The proof-of-concept is public on the ASSET Research Group's GitHub, and the team has published its full disclosure and technical write-up.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.