GhostCommit: Prompt Injection Hidden in Images Steals Agent Secrets
Attackers concealed instructions inside PNG images that AI coding agents ingest and 'read.' When agents like Cursor and Google Antigravity processed the image, the hidden prompt executed — steering them to collect and exfiltrate developer secrets.
What happened
Reported in July 2026, GhostCommit hides prompt-injection payloads inside images — PNG files that AI coding agents pull into context and “read” as part of a task. Multimodal agents such as Cursor and Google Antigravity interpret the concealed text as instructions, at which point the injection drives the agent to locate and exfiltrate developer secrets.
The image vector matters because teams that have started sanitizing text inputs often still treat images as inert. A screenshot pasted into a coding agent, an asset in a repo, or an attached diagram becomes a delivery channel for instructions the agent will faithfully follow.
Why it maps to ATLAS
- AML.T0051.001 — LLM Prompt Injection: Indirect: the instructions arrive through image content the agent ingests, not the user prompt.
- AML.T0055 — Unsecured Credentials: the agent is steered to read local secrets.
- AML.T0086 — Exfiltration via AI Agent Tool Invocation: the agent’s own tools carry the secrets out.
Detection notes
Multimodal context is an instruction channel. Whatever text an agent recovers from an image — via OCR, captioning, or pixel/metadata parsing — must be treated as untrusted data, never as commands. Watch for agents reading credential files or environment variables shortly after processing an image asset, and put egress controls with secret-scanning in front of agent outbound traffic.
Detection
Log sources
- Agent context-ingestion logs (image/asset reads)
- Tool-invocation + file-read traces
- Outbound network from the agent environment
Signals
- Instruction text recovered from image pixels/metadata entering context
- Agent reading credential files or env after processing an image asset
- Egress carrying secret-shaped payloads following an image read
Mitigations
- Treat image/asset content as untrusted; do not let OCR'd/parsed text act as instructions
- Sandbox agents; separate untrusted asset ingestion from secret access
- Egress controls + secret-scanning on agent outbound traffic