Researchers Sudipta Chattopadhyay and Murali Ediga (University of Missouri-Kansas City ASSET Research Group) demonstrated Ghostcommit: malicious instructions hidden in PNG images in pull requests.
Attack chain: AGENTS.md points to docs/images/build-spec.png containing plain-text exfiltration instructions. AI reviewers treat images as decorative and skip inspection. Cursor driving Claude Sonnet exfiltrated .env on first try via encoded integer constants.
Researchers built multimodal PR defender GitHub app: scans invisible characters, code shape, convention text, and images via LLM. Tested on 80 unseen PRs: blocked all image-based attacks, zero false positives on 30 legitimate PRs.