"Ghostcommit" Hides Prompt Injection Inside PNG Images to Steal Secrets

AI code-review agents Cursor and Google Antigravity (backed by Claude Sonnet, Gemini, and GPT-5.5); Anthropic's Claude Code refused across all tested models

Instructions hidden as readable text inside a PNG referenced by an `AGENTS.md` convention file drive an agent to read a project `.env` byte by byte and emit the secrets as a tuple of integer constants disguised as ordinary code, slipping past secret scanners. One run leaked an entire `.env` as a 311-integer constant containing API keys, database URLs, and cloud credentials. A survey found 73% of merged pull requests across 300 top repositories reached the default branch with no substantive human or bot review

AI code reviewers treat image files as binary blobs and exclude them from analysis, so a prompt injection carried inside an image is never inspected, while encoding stolen secrets as integers evades string-pattern secret detection. Found by Sudipta Chattopadhyay and Murali Ediga (University of Missouri-Kansas City ASSET Research Group)