Cybersecurity researchers have uncovered a sophisticated attack vector that exploits a review gap in AI-assisted code review processes. Dubbed “Ghostcommit,” this malicious technique conceals prompt injection instructions within images, allowing attackers to steal sensitive information from repositories without raising suspicion.
The attack works by embedding the malicious instruction inside a PNG image file, which is then referenced in an AGENTS.md file that coding agents read automatically. The image file contains text instructions that are only readable by AI systems, and not by human reviewers. To make matters worse, even if reviewers were to examine the image file closely, they would see nothing out of the ordinary – a harmless-looking build specification.
The researchers behind Ghostcommit have demonstrated that this attack can fool even advanced coding agents, including Cursor and Antigravity. In one test run, the agent successfully extracted sensitive information from the repository’s .env file without raising any alarms. The stolen data is then encoded as a series of integers and written to the source code, where it remains until an attacker retrieves it by decoding the numbers.
What makes Ghostcommit particularly insidious is that it takes advantage of a blind spot in AI-assisted review processes – namely, the fact that human reviewers rarely examine image files. The attack does not rely on any hidden signals or sophisticated obfuscation techniques; instead, it relies on the assumption that reviewers will never open the image file at all.
The Ghostcommit researchers have also highlighted the importance of tooling in AI-assisted code review processes. In their experiments, they found that the coding tools used – such as Cursor and Antigravity – were more likely to fall victim to the attack than the AI models themselves. This suggests that even advanced AI systems can be vulnerable if they are paired with flawed or poorly configured tools.
The Ghostcommit attack is not an isolated incident – it builds on a long history of research into the vulnerabilities of AI-assisted code review processes. As researchers have demonstrated in the past, hiding instructions inside images for AI systems to act on is a well-known technique that can fool even advanced security tools.
In light of this discovery, organizations should take immediate action to strengthen their code review processes and ensure that they are not vulnerable to similar attacks. This includes implementing more stringent checks on image files and ensuring that coding agents are properly configured to detect and prevent such attacks. By staying ahead of emerging threats like Ghostcommit, organizations can protect themselves against even the most sophisticated cyberattacks.
Source: Bleeping Computer — 2026-07-11