AIBleepingComputerabout 2 hours ago
Ghostcommit hides prompt injection in PNG images
1 min read
Researchers built Ghostcommit, a pull request that steals repository secrets by hiding malicious instructions inside a PNG that AI code reviewers never open. The attack exploits a blind spot where reviewers exclude image files from review. Cursor and Antigravity coding tools leaked the.env under multiple models, while Claude Code refused.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
