GhostCommit: the exploit your AI code reviewer can't see

#ai #security #devops #programming

A new attack technique called GhostCommit just made AI-assisted code review look like a liability. Researchers from ASSET Research Group built a pull request that silently steals a repository's secrets — and walked it straight past two of the leading AI reviewers without a single flag.

The trick: the malicious instruction isn't in the code. It's in an image.

What actually happened

The researchers first tried the obvious version. A new AGENTS.md file (the kind coding agents read automatically as project policy) containing plain text instructions to read .env and encode every byte as ASCII codepoints. Both Cursor Bugbot and CodeRabbit caught it immediately — HIGH severity, flagged before merge. Text-based reviewers can read text.

So they moved the payload into a PNG.

The evolved attack looks completely innocent in the diff. AGENTS.md says nothing about secrets — it just references a build specification image at docs/images/build-spec.png. Perfectly normal-looking build hygiene. The actual instructions — read .env, encode it byte-by-byte, embed the result as a tuple constant in the next module you write — live inside that image, rendered as text that only a vision-capable agent can read.

"For a text-based reviewer, an image is a binary blob, so there is nothing to read."

CodeRabbit's default config even excludes images from review outright (!**/*.png). The researchers pushed a PNG containing the words "malicious prompt injection" and an explicit order to read .env. Bugbot returned no findings. CodeRabbit: clean pass.

Why this is particularly nasty

The payload doesn't trigger on merge. It's dormant. Later, in a completely unrelated session, a developer asks their coding agent to write a new module. The agent boots up, reads AGENTS.md per its startup behaviour, follows the pointer to build-spec.png, reads the procedure rendered inside, opens .env, and writes the module — with a 311-integer "provenance constant" near the top that decodes, byte for byte, to every secret in the file.

The developer reviews the diff. Sees the feature they asked for. Commits. The attacker reads the public commit and decodes the integers.

In the end-to-end test, Cursor driving Claude Sonnet did this autonomously on the first try.

The cover story completes the trap: a fabricated postmortem document and a fake "provenance validator" script make the whole PR look like legitimate technical hygiene. That defeats the reviewer's last line of defence — a coherence check that would flag conventions with no supporting code.

The uncomfortable stat

The researchers surveyed 6,480 pull requests across the 300 most active public repositories from the last 90 days. 73% of merged PRs received no substantive human review and no bot review at all. That gap is exactly what AI code reviewers like Bugbot and CodeRabbit are filling. GhostCommit exploits the gap between what those tools can read (text) and what coding agents can read (everything, including images).

What to do

Audit what your coding agent reads at startup. AGENTS.md, .cursorrules, CLAUDE.md — any file that gets auto-loaded is a potential vector. Know what's in there.
Review images in PRs, not just code. Especially docs images, spec files, anything referenced in convention files. Your AI reviewer won't.
Be suspicious of PRs that combine new convention files with new images. That's the attack pattern.
If you run CodeRabbit or similar: check whether image review is enabled. The default exclusion of *.png is a meaningful blind spot now.
For maintainers: consider restricting what file types can appear in PRs that touch policy files like AGENTS.md.