Ghostcommit hides agent attacks inside a pull request's images
Reviewers skip image files. Text scanners see a binary blob. The agent reads the merged convention file later and quietly exfiltrates the repo's secrets. The tooling decides, not the model.
- Ghostcommit, from UMKC's ASSET Research Group, hides prompt-injection instructions inside a PNG image in a pull request, turning AI coding agents into secret-stealers in later, unrelated sessions.
- The attack worked against Cursor and Antigravity paired with Claude, Gemini, and GPT-5.5 models, but Claude Code refused it across all tested models: the agent harness matters more than the base model.
- The researchers' countermeasure, a multimodal pull-request defender, blocked 79 of 80 unseen attacks with zero false positives.
The newest coding-agent attack does not touch the code. Researchers at the University of Missouri-Kansas City's ASSET Research Group disclosed Ghostcommit, a proof of concept that hides prompt-injection instructions inside a PNG image within a pull request, BleepingComputer reported. Human reviewers skip image files, and text-only PR scanners, including CodeRabbit and Bugbot, see only a binary blob. The payload rides in through an AGENTS.md convention file pointing at the crafted image, and detonates later: in an unrelated session, the agent reads the merged convention file, opens the repo's .env, encodes each secret byte, and writes it into a module constant the attacker decodes at leisure.
The harness decides, not the model
The study's most useful finding is architectural. The attack succeeded against Cursor and the Antigravity tool combined with Claude Sonnet, Claude Opus, Gemini, and GPT-5.5, but Anthropic's Claude Code refused it across every model tested. Same models, different harness, opposite outcome, which the research summarizes as: the tooling decides, not the model. The researchers, who disclosed to vendors before publication, also built a countermeasure, a multimodal pull-request defender running on a 4GB GPU that scans images and text for hidden instructions; it blocked 79 of 80 unseen attacks with zero false positives across 30 legitimate PRs.
Context is the new supply chain
Ghostcommit slots into a widening family of attacks on what agents read rather than what they run, alongside HalluSquatting's squatted package names: package-borne last week, image-borne this week, always aimed at the context an agent trusts. It lands in an ecosystem where 99.9 percent of fixable AI vulnerabilities sit unpatched and where autonomy defaults keep expanding, as when auto mode became the enterprise default. For buyers, the checklist item is now specific and testable: does your coding agent's harness refuse instructions found in repository content? One of the tested harnesses did. The rest complied.