A malicious request for a change in code can be checked without a single comment, and a few days later force the AI assistant imperceptibly to take out the secrets of the project. To attack, it is enough to hide the instructions inside a regular PNG file, which the code verification systems do not even open.
Specialists of the ASSET group at the University of Missouri in Kansas City called this method GhostCommit. They published a working example of an attack and notified the developers of the affected tools in advance.
The attack takes place in two stages. First, the attacker sends a request to change the repository and adds the AGENTS.md file with the rules for AI assistants. The file itself looks harmless and only refers to the image of docs/images/build-spec[.]png. Inside the picture and contains hidden instructions.
CodeRabbit and Bugbot systems found no problem. CodeRabbit by default excludes images from the check, so PNG is perceived as a regular binary file. Even the inscriptions “malicious prompt injection” and the direct requirement to read .env did not cause warnings.
After the changes merge into the project, the malicious instructions remain in the code and wait for the right moment. When the developer asks the AI assistant to create a regular module, the agent reads AGENTS.md, opens the picture and executes hidden commands. In one of the tests, Cursor with Claude Sonnet recorded the contents of .env in the form of 311 integers. After the reverse conversion, the sequence completely coincided with the original file.
The developer sees the requested function and can send the code to the general repository. The attacker stays to download the open version of the file and convert the numbers back to the text. Ordinary leak search tools do not notice the problem, as they do not consider the motorcade or list of counts to be accountable.
The authors of GhostCommit also checked how much the result depends on the chosen model. Cursor and Antigravid revealed the contents of .env when working with Sonnet, Gemini and GPT-5.5. The Claude Code with the same models refused to execute the command. In one case, the Opus first recorded a secret, then recognized the deception and deleted the data. The result was more dependent on the launch medium of the agent than the language model itself.
The problem is reinforced by a weak test of changes in popular projects. Having studied 6480 requests for a change in 300 active open repositories, experts установилиfound that 73% of the adopted changes were included in the main branch without a meaningful check on the part of a person or an automatic system.
To protect themselves, experts have created a multimodal check module for GitHub, which analyzes not only text and code, but also images. When tested for 80 previously unknown requests, he missed one attack, found all the options that hide the instructions in the pictures, and did not issue false warnings for 30 safe changes. Additionally, the system can control the actions of the AI agent, including attempts to hide the instructions and open files with the account for no apparent reason.
Specialists of the ASSET group at the University of Missouri in Kansas City called this method GhostCommit. They published a working example of an attack and notified the developers of the affected tools in advance.
The attack takes place in two stages. First, the attacker sends a request to change the repository and adds the AGENTS.md file with the rules for AI assistants. The file itself looks harmless and only refers to the image of docs/images/build-spec[.]png. Inside the picture and contains hidden instructions.
CodeRabbit and Bugbot systems found no problem. CodeRabbit by default excludes images from the check, so PNG is perceived as a regular binary file. Even the inscriptions “malicious prompt injection” and the direct requirement to read .env did not cause warnings.
After the changes merge into the project, the malicious instructions remain in the code and wait for the right moment. When the developer asks the AI assistant to create a regular module, the agent reads AGENTS.md, opens the picture and executes hidden commands. In one of the tests, Cursor with Claude Sonnet recorded the contents of .env in the form of 311 integers. After the reverse conversion, the sequence completely coincided with the original file.
The developer sees the requested function and can send the code to the general repository. The attacker stays to download the open version of the file and convert the numbers back to the text. Ordinary leak search tools do not notice the problem, as they do not consider the motorcade or list of counts to be accountable.
The authors of GhostCommit also checked how much the result depends on the chosen model. Cursor and Antigravid revealed the contents of .env when working with Sonnet, Gemini and GPT-5.5. The Claude Code with the same models refused to execute the command. In one case, the Opus first recorded a secret, then recognized the deception and deleted the data. The result was more dependent on the launch medium of the agent than the language model itself.
The problem is reinforced by a weak test of changes in popular projects. Having studied 6480 requests for a change in 300 active open repositories, experts установилиfound that 73% of the adopted changes were included in the main branch without a meaningful check on the part of a person or an automatic system.
To protect themselves, experts have created a multimodal check module for GitHub, which analyzes not only text and code, but also images. When tested for 80 previously unknown requests, he missed one attack, found all the options that hide the instructions in the pictures, and did not issue false warnings for 30 safe changes. Additionally, the system can control the actions of the AI agent, including attempts to hide the instructions and open files with the account for no apparent reason.
