Imagine: you trust your AI assistant to check code. But instead of finding bugs, it steals your passwords and access keys. And all of this — because of an ordinary PNG image. Sounds like science fiction? No, this is a real attack, named Ghostcommit.
Researchers from the University of Missouri-Kansas City (Associate Professor Sudiptha Chattopadhyay and researcher Murali Ediga) discovered that malicious commands can be hidden not in text, but inside an image. An AI agent that checks code before publication doesn't even open the image and calmly lets everything through. Later, another AI assistant reads that image, finds the command within it, accesses the secret file with passwords and keys, and quietly inserts them into the code disguised as a harmless set of numbers.
What is the essence of the deception?
It all starts with the fact that real code review has almost stopped. Consequently, vulnerabilities are being discovered more and more often. The researchers looked at over 6,000 changes in the most popular open-source projects and found that in 73% of cases, code was added to the project without any meaningful review — neither a human nor a program checked it.
Programmers often keep keys, passwords, and accesses in a separate service file (usually called .env). And AI programs — something like an automatic editor that reads changes and says if everything is okay — are increasingly helping them review new code.
The trick itself is as follows. AI assistants have a special project rules file that they read themselves and consider something like an instruction manual "how things are done here." The hacker leaves a harmless text about build settings in this file — no passwords are mentioned there. The file only references an image. And it is in the image that the malicious command is written: read the secret file, convert each character into a number, and insert these numbers into the code.
For the reviewing program, the image is just a set of data that it doesn't parse. Some AIs don't look at images by default at all, others find nothing suspicious. The researchers even wrote "malicious command" and "read the secret file" directly on the image — and the review still passed successfully.
The theft doesn't happen immediately. The command is, as it were, "sleeping." Time passes, the programmer asks the AI assistant to do something ordinary — for example, add a small piece of code. Upon launch, the assistant reads that same rules file, follows the link to the image, opens the secret file, and discreetly inserts the passwords into the code as a long list of numbers. In one test, the assistant wrote the entire secret file completely on the first try. The programmer sees that the required function is ready and publishes the code. The hacker then simply takes these numbers from the open project and turns them back into passwords. Regular security programs notice nothing — it "doesn't even occur to them" that keys are hidden behind a harmless list of numbers.
It's not about the AI, but the program
Hiding commands in images was invented long ago, but Ghostcommit has no camouflage: the command is written directly, in plain text. It's not clever concealment that works, but simple inattention — the reviewer just doesn't look inside the image.
The most curious thing is something else. It turned out that what matters more is not which specific "brain" (AI model) is inside, but which program it is embedded in. The same AI in one program obediently stole passwords, while in another it recognized the trick and refused. In one case, the assistant even first wrote down the secret, then realized it was being deceived, and erased what it had written. The "brain" is the same, but the behavior is opposite, because everything is determined by the shell around it.
Hence the conclusion: there is no single magical defense; multiple levels are needed. The researchers themselves created their own program that actually opens and reads images. In a test on 80 new changes, it missed only one attack and never raised a false alarm on honest code.
The second level of defense is to monitor what the assistant does during its work: if it suddenly accesses the password file without reason, that's a reason to be wary.
My comment: Ghostcommit is not just another hacker invention, but a symptom of a systemic problem. We have trusted AI agents with critically important tasks too quickly, without providing them with an adequate "immune system." Until developers implement multi-level checks, including image content analysis and agent behavior monitoring, such attacks will only multiply. The cryptocurrency market, where code security equals fund security, should pay special attention to this.