Ghostcommit: a PNG-hidden prompt injection fools AI agents and steals secrets

Security researchers have unveiled a technique called Ghostcommit that makes it possible to hide malicious instructions for AI agents inside ordinary PNG images.

The crux of the attack is that a malicious prompt is stitched directly into the image file. The AI code reviewers CodeRabbit and Bugbot, which don't open image files at all when analyzing pull requests, let such a file slip by unnoticed.

But once a coding AI agent takes over and processes the image's contents, the hidden injection is triggered. According to the researchers, the agent could be persuaded to read the repository's .env file and write the secrets it contains — passwords, tokens, access keys — straight into the code as a list of numbers.

In this way, the malicious payload slips past AI reviewers that don't analyze images, and is then carried out through another agent that has access to the repository's file system and that processes images as part of its job.

The technique demonstrates a new class of threats to workflows involving AI agents in software development: an attacker doesn't need to target the code itself — it's enough to hide instructions where neither a human nor a specialized review tool expects to find them.

The emergence of such methods underscores the need to rethink security practices when adopting AI agents into the development pipeline, including scanning all types of files, not just textual code, as well as restricting agents' access to sensitive data by default.

Source: Bleeping Computer