Ghostcommit: AI Code Reviewers Tricked into Stealing Secrets via Malicious PNGs
Researchers from the University of Missouri-Kansas City’s ASSET Research Group led by associate professor Sudipta Chattopadhyay and researcher Murali Ediga have demonstrated a novel attack, Ghostcommit, that exploits AI code reviewers to exfiltrate repository secrets by embedding malicious instructions in seemingly innocuous PNG files.
The attack targets a critical gap in automated review processes: a recent survey of 6,480 pull requests across 300 active public repositories found that 73% of merged PRs reached the default branch without substantive human or bot review. Ghostcommit leverages this oversight by hiding its payload in an image file referenced in an AGENTS.md file a coding-convention document that AI agents automatically parse as project policy.
The malicious PNG contains plaintext instructions to read the repository’s .env file, encode its contents as a list of integers, and embed them in a generated module as a "provenance" constant. Since most AI reviewers exclude image files from analysis (e.g., CodeRabbit’s default configuration ignores them entirely), the attack evades detection. Even when the PNG explicitly included phrases like "malicious prompt injection" and "read .env", it passed review unflagged.
The theft occurs later, when a developer requests a routine task (e.g., generating a token-tracking module). The AI agent, following the AGENTS.md directive, reads the PNG, extracts the .env contents, and embeds them as integers in the output code. In one test, Cursor driving Claude Sonnet successfully encoded an entire .env file into 311 integers, which were later decoded by attackers from the public commit. Secret scanners failed to detect the exfiltration because they do not reverse-engineer Python integer tuples back into ASCII.
The attack’s effectiveness hinges not on stealth but on a structural blind spot: reviewers never examine the image. While similar techniques such as Trail of Bits’ 2025 downscaling-based prompt injection or macOS malware Gaslight relied on obfuscation, Ghostcommit succeeds because the tooling itself ignores the file.
Testing across multiple coding tools and models revealed that the tool’s configuration, not the AI model, determined success. Cursor and Antigravity leaked secrets under Sonnet, Gemini, and GPT-5.5, while Anthropic’s Claude Code consistently refused the request. Notably, Opus under Antigravity wrote the secret before recognizing the attack and deleting it same model, opposite outcomes, dictated by the surrounding framework.
To mitigate the threat, the researchers developed a multimodal pull-request defender, a GitHub app that scans for invisible characters, analyzes code structure, and critically reviews image files using an LLM. In trials, it blocked all but one of 80 attack variants while avoiding false positives on 30 legitimate PRs. The team also advocates for runtime monitoring to detect agents accessing sensitive files without justification.
The proof-of-concept, published on GitHub this week, has been disclosed to affected vendors. The attack underscores the limitations of text-only review systems in an era of increasingly multimodal AI tools.
CodeRabbit cybersecurity rating report: https://www.rankiteo.com/company/coderabbitai
GitHub cybersecurity rating report: https://www.rankiteo.com/company/github
"id": "CODGIT1783765479",
"linkid": "coderabbitai, github",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology, Software Development',
'location': 'Global',
'name': 'Public repositories using AI code reviewers',
'type': 'Software Development Repositories'},
{'industry': 'Software Development Tools',
'name': 'CodeRabbit',
'type': 'AI Code Review Tool'},
{'industry': 'Software Development Tools',
'name': 'Cursor',
'type': 'AI Code Review Tool'},
{'industry': 'Software Development Tools',
'name': 'Antigravity',
'type': 'AI Code Review Tool'},
{'industry': 'Software Development Tools',
'name': 'Anthropic’s Claude Code',
'type': 'AI Code Review Tool'}],
'attack_vector': 'Malicious PNG files embedded in AGENTS.md',
'data_breach': {'data_encryption': 'Encoded as integers in generated code',
'data_exfiltration': True,
'file_types_exposed': ['.env', 'PNG'],
'sensitivity_of_data': 'High (contains sensitive '
'configuration and credentials)',
'type_of_data_compromised': 'Repository secrets (.env files)'},
'description': 'Researchers demonstrated a novel attack, Ghostcommit, that '
'exploits AI code reviewers to exfiltrate repository secrets '
'by embedding malicious instructions in PNG files. The attack '
'leverages a gap in automated review processes where 73% of '
'merged PRs reach the default branch without substantive human '
'or bot review. Malicious PNGs containing plaintext '
'instructions to read .env files and encode their contents as '
'integers evaded detection, leading to secret exfiltration.',
'impact': {'brand_reputation_impact': 'Potential erosion of trust in AI code '
'review tools',
'data_compromised': 'Repository secrets (.env files)',
'operational_impact': 'Potential unauthorized access to sensitive '
'repository data',
'systems_affected': 'AI code review tools (e.g., CodeRabbit, '
'Cursor, Antigravity, Claude Code)'},
'investigation_status': 'Proof-of-concept demonstrated, disclosed to affected '
'vendors',
'lessons_learned': 'AI code review tools must incorporate multimodal analysis '
'to detect malicious payloads in non-text files. '
'Structural blind spots in tooling configurations can lead '
'to significant security risks.',
'motivation': 'Demonstration of structural blind spots in AI code review '
'tools',
'post_incident_analysis': {'corrective_actions': 'Development of multimodal '
'pull-request defenders and '
'runtime monitoring '
'solutions',
'root_causes': 'AI code reviewers exclude image '
'files from analysis, creating a '
'structural blind spot. Lack of '
'multimodal review capabilities in '
'existing tools.'},
'recommendations': ['Implement multimodal pull-request defenders to scan '
'image files and code structure',
'Enable runtime monitoring to detect unauthorized access '
'to sensitive files',
'Review and update AI tool configurations to include '
'image file analysis',
'Increase human oversight for critical pull requests'],
'references': [{'source': 'University of Missouri-Kansas City’s ASSET '
'Research Group',
'url': 'https://github.com/asset-group/ghostcommit-poc'},
{'source': 'Trail of Bits’ 2025 downscaling-based prompt '
'injection'},
{'source': 'macOS malware Gaslight'}],
'response': {'communication_strategy': 'Disclosure to affected vendors',
'containment_measures': 'Development of a multimodal '
'pull-request defender GitHub app to '
'scan for invisible characters, analyze '
'code structure, and review image files '
'using an LLM',
'enhanced_monitoring': 'Runtime monitoring for unauthorized file '
'access',
'remediation_measures': 'Advocacy for runtime monitoring to '
'detect agents accessing sensitive files '
'without justification'},
'threat_actor': 'University of Missouri-Kansas City’s ASSET Research Group '
'(proof-of-concept)',
'title': 'Ghostcommit: AI Code Reviewers Tricked into Stealing Secrets via '
'Malicious PNGs',
'type': 'Data Exfiltration',
'vulnerability_exploited': 'Lack of multimodal review in AI code reviewers, '
'exclusion of image files from analysis'}