Back Ground.News

Researchers hid a prompt injection inside a PNG, and AI fell for it

Ground.News • July 12, 2026

A seemingly harmless PNG image could fool AI coding assistants into exposing sensitive data, according to new security research.

A novel supply chain attack called “Ghostcommit” that conceals prompt-injection instructions within PNG images to bypass AI code reviewers and trick coding agents into leaking secrets such as .env files. The ASSET Research Group demonstrated that a pull request containing an explicit, plain-text instruction to exfiltrate a repository’s .env file is caught immediately by LLM-based […] The post New Ghostcommit Attack Hides Malicious Prompts in Ima…

Researchers have built a pull request that steals a repository’s secrets by hiding the malicious instruction inside a PNG that AI code reviewers never open. The reviewer waves the change through. Later, a coding agent reads the picture, opens the repo’s .env, and writes every key into the source as a harmless-looking list of numbers. How ‘Ghostcommit’ works The attack is joint work from the University of Missouri-Kansas City’s ASSET Research Gro…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghostcommit Attack Exploits AI Reviewers to Steal Secrets Researchers from the ASSET Research Group demonstrated a new attack method called 'Ghostcommit' that hides malicious instructions within PNG images to bypass AI code reviewers. The attack exploits a significant gap in the review process, with a survey revealing that 73% of merged pull requests in active repositories receive no substantive human or bot review. The malicious payload, concealed in an image, instructs coding agents to read sensitive files like .env and exfiltrate secrets as seemingly harmless data. This attack method poses a serious risk to software supply chains, as compromised repositories can lead to extensive downstream damage. The researchers disclosed their findings to affected vendors and published a proof-of-concept on GitHub. The attack highlights vulnerabilities in AI-assisted code review processes and the need for improved security measures. 3 sources 66

Extracted Entities

Researchers hid a prompt injection inside a PNG, and AI fell for it

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)