Executive Summary
Researchers demonstrated Ghostcommit: a PNG with a hidden prompt injection caused coding agents to read a repository's .env file and expose secrets through code, bypassing AI code reviewers that did not inspect images.
What Happened
Researchers demonstrated a technique called Ghostcommit in which a PNG containing a hidden prompt injection caused coding agents to read a repository’s .env file and expose secrets through code. The technique reportedly bypassed AI code reviewers that did not inspect image files, creating a risk for software teams using agentic development tools.
Vulnerability / Attack Technique
Prompt injection hidden in an image file
Technical Mechanism
Instructions embedded in a PNG were read by coding agents, which then accessed .env and leaked secrets in generated code; AI reviewers missed it because they skipped images.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Multimodal agents read instructions from images that humans and review tools do not inspect. RealGround analysis: secrets should not be readable by coding agents at all, because input filtering will always miss a format.
Recommended Controls
- Keep .env and secrets out of coding agents' file access
- Review image and binary files in pull requests
- Scan agent-generated code for embedded secrets
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
BleepingComputer: https://www.bleepingcomputer.com/tag/ai-agent/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.