One Image, Two Readers: How a PNG Steals Your Secrets

AGENTS.md is the rules file your coding agent reads and trusts by default. A new attack called Ghostcommit turns it into the entry point, pointing to an image that tells your agent to steal your own secrets.

🧩 The entry point

An attacker adds an AGENTS.md through a normal pull request, made boring so nobody flags it. It looks like an ordinary build convention that points to an image, and it never mentions a password, a key, or the .env file, so nothing looks like an attack. And AI reviewers skip images by default, since tools like CodeRabbit ship configured to exclude PNG files.

🖼 One file the reviewer skips

The malicious instruction is not in the code, it is written as plain text inside the image, the way words appear on a screenshot. A text reviewer never opens the image, so it sees only an unreadable blob. But your coding agent runs on a multimodal model that reads images directly, so it opens the picture, reads the instruction, and pulls your .env file (which holds your passwords and keys) one byte at a time.

🔢 When the leak actually happens

Nothing is stolen when the pull request merges. The trap just sits in the repo, then wakes up in a later session, when you ask the agent for an ordinary feature. Your agent reads the planted AGENTS.md, opens the image, reads your .env, and turns each byte into a number, writing the list into a constant named _PROV_CANARY, 311 numbers long in the test. The name, the numbers, and the build story all fit together, so a human scanning the change sees a build fingerprint, not credentials. Your secrets end up saved openly, inside your own code.

You might expect the agent to refuse an order like read the .env and encode it. It does not, because the theft is dressed as a safety check. The instruction tells it to confirm the numbers decode back to the real .env before committing, so reading the secret looks like the agent checking its work. The habit meant to keep it safe is what causes the leak.

🧪 Tested, not theoretical

Researchers at the University of Missouri-Kansas City built and ran this end to end. No live campaign has been reported yet, but every piece works. Cursor and Google's Antigravity agent both followed the image and leaked the .env, and Cursor's own review bot found nothing, even when the image said "malicious prompt injection" outright. And across 300 active public repos, 73 percent of merged pull requests reached the main branch with no review at all, the blind spot this counts on.

🛡 How to protect yourself

▸ Turn off agent vision in automated pipelines with no human watching ▸ Sandbox the agent so it cannot reach .env in the first place ▸ Stop excluding images from code review

Ghostcommit is not really about the model. It works because of what the agent around it is allowed to read and do. Fix that, and the same image does nothing.