Ghostcommit: Image-Based Prompt Injection Targeting AI Coding Agents

Technical Analysis

The attack embeds natural-language instructions within image data (steganographically or via metadata) that are invisible to text-based static analysis and to code-review bots that skip binary/image files entirely. When a multimodal coding agent later processes the repository and renders or analyzes the image (e.g., during a PR review, documentation generation, or agentic coding task), it interprets the embedded text as legitimate instructions rather than data. The injected instructions direct the agent to read sensitive files (.env) and exfiltrate the contents by writing them into source code disguised as an innocuous numeric list, bypassing secret-scanning tools that look for known key patterns. This crosses the boundary between an untrusted artifact (image) and an agent's privileged execution context (file system access, commit/write permissions), turning a passive review pipeline into an active exfiltration channel.

Affected Systems

CodeRabbit, Bugbot

Detection Signatures

• Commits or PRs introducing new/modified image files with unusually large file size relative to visual content or with embedded text-like entropy patterns
• Agent tool-call logs showing .env or credential file reads immediately following image analysis steps
• Source code diffs adding long numeric arrays with no clear functional purpose (potential encoded secrets)
• Code-review or CI logs indicating image files were skipped/unscanned by static analysis but were opened by an AI agent later in the pipeline
• Unexpected outbound behavior: secrets appearing in code, comments, or generated documentation shortly after an image-processing step

Remediation Steps

1. 1

   Scan image files for embedded text/steganographic payloads

   Add pre-commit or CI scanning that inspects image binaries (EXIF, LSB analysis, appended data) for hidden instruction-like text before agents process them.

2. 2

   Sandbox and restrict agent file-system access

   Ensure coding agents operate with least privilege, without automatic access to .env or secret files unless explicitly required and audited.

3. 3

   Treat all agent-ingested content as untrusted input

   Apply prompt-injection defenses (input/output filtering, instruction hierarchy enforcement) uniformly across text, images, and other modalities, not just text.

4. 4

   Enforce secret-scanning on all output artifacts

   Run secret detection on generated code/commits, including checks for encoded/obfuscated formats like numeric arrays, not just plaintext key patterns.

5. 5

   Extend code review tooling to cover binary/image files

   Close the gap where reviewers like CodeRabbit/Bugbot skip non-text files entirely, or flag repos containing unreviewed binary content for manual inspection.

6. 6

   Rotate and revoke exposed secrets

   Immediately rotate any credentials in .env files within repositories that use AI coding agents with image-processing capabilities.