GhostCommit: Prompt Injection Hidden Inside Images to Steal Secrets

What it is — A writeup of the “GhostCommit” attack, which hides malicious prompt-injection instructions inside PNG images referenced by config files, so a coding agent that reads the image later leaks repo secrets while text-based reviewers never open the binary.

Key points

• A developer’s later routine request makes the agent follow the hidden image instructions, pull secrets from .env files, and encode them as innocuous-looking integer lists that slip past secret scanners.
• Which coding platform (e.g. Cursor, Antigravity) is running mattered more to whether the attack succeeded than the underlying model — Claude Code refused the attack across every model tested.
• A concrete reminder that any binary asset pulled into a project (stock images, placeholders, loading spinners) is a plausible injection vector agents can act on without a human ever “reading” it.