Ghostcommit attack hides prompt injection in PNG to steal repository secrets

Ghostcommit is a novel software supply-chain attack that exploits the trust coding agents place in visual assets. The researchers embedded malicious instructions inside a PNG file, which is referenced by an AGENTS.md file used by AI coding tools (e.g., Copilot, Codex agents). When a developer or automated agent opens the image, the hidden prompt instructs the agent to extract secrets from the repository's .env file, convert them into encoded integers, and write those integers directly into the source code as a new commit. Because the malicious payload lives in a binary image, text-based reviewers see only a benign blip, while downstream agents faithfully execute the injected commands.

To quantify the threat, the team surveyed 6,480 pull requests across the 300 most active public repositories over 90 days. They found that 73% of merged PRs reached the default branch with no substantive human review and no automated bot review whatsoever. This widespread lack of oversight makes Ghostcommit particularly dangerous: a single malicious PR carrying an AGENTS.md that references a poisoned PNG could compromise every repository that trusts the agent's output. The researchers have notified major vendors and published their findings. While no active exploitation has been confirmed, the attack surface is alarmingly large.