Ghostcommit hides prompt injection in PNG images to steal repo secrets via AI agents

Researchers disclosed Ghostcommit, a supply-chain attack that hides malicious instructions inside a PNG image referenced by an AGENTS.md file.

Text-based AI reviewers skip the image, so the pull request merges cleanly; later, a vision-capable coding agent reads the image, exfiltrates the .env file byte-by-byte, and writes secrets as an integer tuple.

Across 6,480 PRs in the 300 busiest public repos, 73% of merged PRs reached the default branch without substantive review.