'Ghostcommit' Attack Hides Prompt Injections in Images to Trick AI Coding Agents

A notable element of the demonstration involved two AI-based code review tools, CodeRabbit and Bugbot. BleepingComputer reported that the Ghostcommit technique bypassed both reviewers because they do not open or analyze image files as part of their review process. As a result, the malicious payload hidden within the image was not examined, allowing it to move through the review stage undetected.

The finding underscores a gap in how some automated review systems evaluate contributions. Where human reviewers might scrutinize unusual file changes, AI reviewers that focus only on code text may overlook non-code assets such as images, leaving a potential avenue for abuse.

Why It Matters

The demonstration reflects broader concerns about prompt injection, a security issue that has gained prominence as organizations adopt AI agents capable of taking actions on their behalf. When such agents are granted access to file systems, repositories, or credentials, instructions hidden in seemingly benign content can carry outsized consequences.

For development teams globally — including the growing number of engineering hubs across Africa and Europe that rely on AI-assisted tooling and automated review pipelines — the research points to the importance of treating AI agents as part of the software supply chain's threat model. Practices such as limiting agent access to sensitive files, scrutinizing all file types in review processes, and isolating secrets from automated tooling are among the considerations raised by attacks of this kind.

The Ghostcommit demonstration is a proof of concept rather than a report of a confirmed real-world breach. Still, it illustrates how the interaction between AI systems and everyday development assets can create new and non-obvious pathways for data exposure.