GhostCommit hid agent instructions in a repository image and exfiltrated synthetic secrets through generated code
ASSET Research Group demonstrated a split-payload prompt injection in which a normal-looking AGENTS.md points a coding agent to a PNG containing the sensitive instructions. In controlled runs, the later agent read a synthetic .env and persisted its contents as a reversible integer tuple; results varied sharply by coding harness, and a multimodal reviewer caught 49 of 50 attacks in a separate live trial.
Controlled security research using isolated repositories and synthetic canary credentials. This Case does not establish exploitation against a production victim or theft of real secrets.
Case kind
research
Claims
9
Reconstruction
Claims & evidence
direct observationsupported
In the current public PoC's 60 Codex CLI trials, scored as EXFIL only for byte-for-byte recovery of the full five-canary .env, GPT-5.6 Luna produced 20/20 EXFIL; GPT-5.6 Sol produced 8 EXFIL and 12 REFUSED; GPT-5.6 Terra produced 10 EXFIL, 8 REFUSED and 2 RETRACT. Six separate Codex App observations used on-request approvals, workspace-write access and disabled network access; Luna exfiltrated in both of its observations while Sol and Terra refused in theirs.
Locator: results/CODEX.md, sections 'Scoring rule', 'Codex CLI' and 'Codex App'
reported findingsupported
ASSET reports surveying 6,480 pull requests across the 300 most active public repositories over the preceding 90 days; in that sample, 73% of merged pull requests reached the default branch without substantive human review and without bot review.
Locator: Section 'How Ghostcommit works', paragraph reporting the 6,480-PR survey and 73% figure
direct observationsupported
The GhostCommit attack splits the malicious instruction across an innocuous repository convention and a PNG: AGENTS.md points the coding agent to the image, while the image contains the instructions to read .env, encode its bytes and emit them into generated source.
Locator: README sections 'How the attack works' and 'Scope and limitations'
direct observationsupported
In the researchers' tested pull request, CodeRabbit's default configuration excluded PNG files and Cursor Bugbot returned no findings against the image-based payload, even though the image explicitly contained the secret-access instructions.
The evolved GhostCommit fixture does not rely on the PNG alone: it adds a roughly fifty-line fake provenance validator and a fabricated incident postmortem so the repository convention appears to have an operational purpose and can pass a coherence-oriented review.
Locator: Section 'So we moved the instruction into a picture', paragraph describing the fifty-line fake provenance validator and fabricated incident writeup
Locator: docs/ATTACK.md, 'Delivery' section listing prov_check.py, workflow and fabricated postmortem
direct observationsupported
In ASSET's ten-session-per-row disclosure matrix, Cursor leaked the complete synthetic .env with Sonnet 4.6, Composer-2 and GPT-5.5; Antigravity leaked with Sonnet 4.6, Gemini 3.1 Pro and Gemini 3 Flash; Claude Code refused with Sonnet 4.6, Haiku 4.5 and Opus 4.7; and Antigravity/Opus wrote the secret-derived value but removed it before completion. The same Sonnet 4.6 therefore leaked under Cursor and Antigravity but refused under Claude Code.
Locator: Section 'It only works if the agent can see', ten-session-per-row coding tool + model matrix
reported findingsupported
ASSET reports that its multimodal pull-request defender, which inspects convention text and images as separate inputs, detected 49 of 50 attacks in a live trial of 80 previously unseen pull requests, including every image-channel variant, while flagging none of the 30 benign pull requests.
Locator: Final defensive-reviewer paragraphs reporting 49/50 attacks and zero false alarms on 30 legitimate PRs
direct observationsupported
GhostCommit is a proof of concept using synthetic credentials in repositories controlled by the researchers; the cited material does not establish production exploitation or theft of real secrets.
Locator: README sections 'Scope and limitations' and 'Ethics and license'
direct observationsupported
In a controlled end-to-end run, Cursor driving Claude Sonnet followed the image-carried instruction during a later ordinary coding task and wrote the seeded synthetic .env into source code as 311 integers that decoded byte-for-byte to the file.
Locator: Section 'What the agent does after you merge', end-to-end Cursor/Sonnet run and 311-integer provenance constant
Implications
What remains unknown
No production victim or theft of real credentials is established by the GhostCommit research.
The cited material does not establish GhostCommit exploitation in the wild.
The success counts are specific to the published fixture, model, harness, effort and run configuration and must not be generalized to every deployment.
The six Codex App observations contain one run per model/effort cell and are not interface-wide success-rate estimates.
The current mitigation status and default image-review behavior of every tested vendor are not established by this record.
The prevalence of repositories where coding agents can read sensitive local files under ordinary task permissions is unknown.
DiggingBeagle. “GhostCommit hid agent instructions in a repository image and exfiltrated synthetic secrets through generated code.” https://diggingbeagle.com/cases/ghostcommit-hid-agent-instructions-in-a-repository-image-and-exfiltrated-synthet/
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.