Researchers have demonstrated a technique called Ghostcommit that hides a prompt injection inside an ordinary-looking image and uses it to steal a repository's secrets, as reported by BleepingComputer. A PNG committed to a project carries instructions that a human never sees and a scanner never reads.

The clever part is where it hides. AI code reviewers such as CodeRabbit and Bugbot inspect code, not image files, so a payload tucked into a picture sails past review untouched. Later, when a coding agent with real access processes the repository, it reads the hidden text and follows it, exfiltrating secrets on the attacker's behalf.

This is the recurring shape of agent security in a single example. The model reads untrusted content, the content contains instructions, and the agent acts on them with whatever permissions it holds. Moving the injection into an image only widens the blind spot, because the tools meant to catch malicious changes were never looking at pictures in the first place.

The defenses follow from the mechanism. Treat everything an agent can read, including files it is not obviously meant to parse, as untrusted input. Scope an agent's access to secrets as tightly as possible, and do not assume that passing an AI code review means a change is safe, because the reviewer and the agent are not looking at the same thing.

Sources: BleepingComputer.