Ghostcommit: AI Code Reviewers Tricked into Stealing Secrets via Malicious PNGs Researchers from the University of Missouri-Kansas City’s ASSET Research Group led by associate professor Sudipta Chattopadhyay and researcher Murali Ediga have demonstrated a novel attack, Ghostcommit, that exploits AI code reviewers to exfiltrate repository secrets by embedding malicious instructions in seemingly innocuous PNG files. The attack targets a critical gap in automated review processes: a recent survey of 6,480 pull requests across 300 active public repositories found that 73% of merged PRs reached the default branch without substantive human or bot review. Ghostcommit leverages this oversight by hiding its payload in an image file referenced in an `AGENTS.md` file a coding-convention document that AI agents automatically parse as project policy. The malicious PNG contains plaintext instructions to read the repository’s `.env` file, encode its contents as a list of integers, and embed them in a generated module as a "provenance" constant. Since most AI reviewers exclude image files from analysis (e.g., CodeRabbit’s default configuration ignores them entirely), the attack evades detection. Even when the PNG explicitly included phrases like "malicious prompt injection" and "read .env", it passed review unflagged. The theft occurs later, when a developer requests a routine task (e.g., generating a token-tracking module). The AI agent, following the `AGENTS.md` directive, reads the PNG, extracts the `.env` contents, and embeds them as integers in the output code. In one test, Cursor driving Claude Sonnet successfully encoded an entire `.env` file into 311 integers, which were later decoded by attackers from the public commit. Secret scanners failed to detect the exfiltration because they do not reverse-engineer Python integer tuples back into ASCII. The attack’s effectiveness hinges not on stealth but on a structural blind spot: reviewers never examine the image. While similar techniques such as Trail of Bits’ 2025 downscaling-based prompt injection or macOS malware Gaslight relied on obfuscation, Ghostcommit succeeds because the tooling itself ignores the file. Testing across multiple coding tools and models revealed that the tool’s configuration, not the AI model, determined success. Cursor and Antigravity leaked secrets under Sonnet, Gemini, and GPT-5.5, while Anthropic’s Claude Code consistently refused the request. Notably, Opus under Antigravity wrote the secret before recognizing the attack and deleting it same model, opposite outcomes, dictated by the surrounding framework. To mitigate the threat, the researchers developed a multimodal pull-request defender, a GitHub app that scans for invisible characters, analyzes code structure, and critically reviews image files using an LLM. In trials, it blocked all but one of 80 attack variants while avoiding false positives on 30 legitimate PRs. The team also advocates for runtime monitoring to detect agents accessing sensitive files without justification. The proof-of-concept, published on GitHub this week, has been disclosed to affected vendors. The attack underscores the limitations of text-only review systems in an era of increasingly multimodal AI tools.