Researchers at the ASSET Research Group have demonstrated a supply-chain attack called Ghostcommit that exploits a critical gap in how AI code reviewers operate: they don't open image files. The attack hides malicious instructions inside a PNG embedded in an AGENTS.md convention file—the kind of policy document that coding agents read automatically on startup. When a developer later asks their AI agent for a routine feature, the agent follows the image pointer, reads the repository's .env secrets file, and encodes the entire contents as a seemingly innocent integer constant in the generated code. The payload sits dormant until commit, at which point the attacker decodes the numbers from the public repository. The researchers tested this against Cursor and Claude Sonnet, and the agent leaked all 311 bytes of the .env file on the first attempt. This works because 73% of pull requests across the 300 most active public repositories merged with no substantive human or bot review, and because existing code reviewers—including CodeRabbit with its default configuration—explicitly exclude images from review.
The critical insight is that the vulnerability lives not in the AI models themselves but in the tooling that wraps them. Across ten test runs each, Cursor and Antigravity leaked secrets under multiple models (Sonnet, Gemini, GPT-5.5), whilst Anthropic's Claude Code refused the same instruction under every model tested. This means that for CX teams already deploying AI agents in production—whether through Salesforce Agentforce, custom implementations, or third-party tools—the risk isn't that your chosen model is inherently unsafe. The risk is that your agent's execution environment, the way it reads files, the conventions it trusts, and the guardrails around what it can access are the actual attack surface. A developer asking a coding agent to generate a customer data export script, or a support agent reading internal knowledge-base files to answer tickets, operates under the same structural blind spot.
The researchers deployed a multimodal pull-request defender that scans for invisible characters, analyses code shape, runs LLM passes over both convention text and images, and crucially, actually opens attachments. In live trials against 80 unseen pull requests, only one attack escaped it. For CX operations, this points to a defence-in-depth requirement: assume your agents will read files you didn't intend them to read, assume conventions and policies can be poisoned, and assume that runtime monitoring of what agents actually do when they access credentials or sensitive customer data matters more than trying to catch payloads before deployment. The question isn't whether your AI vendor's model is trustworthy—it's whether you can see what your agent is doing when it reads a file it had no business touching.
A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit,' slipped past AI code reviewers CodeRabbit and Bugbot, which never open image files at all, then convinced a coding agent to read a repo's .env and write every secret into th