Definition
Ghostcommit is a proof-of-concept prompt-injection attack where malicious instructions are embedded inside PNG images in pull requests. AI code review tools that treat images as decorative assets absorb hidden instructions and may later exfiltrate sensitive project data disguised as legitimate code values.
Key Points
- Researchers: Sudipta Chattopadhyay and Murali Ediga (University of Missouri-Kansas City ASSET Research Group)
- Attack chain: AGENTS.md or convention file points to innocent-looking PNG → reviewer skips image → agent reads image at runtime → exfiltration encoded as module constants
- Wrapper dependency: Success varies by coding assistant wrapper (e.g., Cursor + Claude Sonnet), not underlying LLM alone
- Defense: Multimodal PR scanning — LLM pass over images, invisible-character detection, code-shape analysis; researchers’ GitHub app blocked all image attacks in 80-PR trial with zero false positives on 30 legitimate PRs
- Related hardening: anthropic claude-code-security-review PR #81 adds pre-prompt injection scanner for PR metadata
Related
- prompt-injection
- ai-agent-security
- supply-chain-security
- multimodal-ai
- coding-agents
- ai-code-assistance
- github
- cursor
- claude-code