We put the exploit in a picture. The AI code reviewer never opened it.

The instruction to steal your .env lives inside a PNG. Text-based reviewers see a binary blob. The coding agent reads it, and later writes your whole .env into the source as a list of numbers.

Almost nobody reviews the pull request. We surveyed 6,480 pull requests across the 300 most active public repositories of the last ninety days, and 73% of the ones that got merged reached the default branch with no substantive human review and no bot review at all. The thing filling that gap is a new kind of reviewer: an LLM that reads every diff and comments like a human would. Cursor Bugbot and CodeRabbit are the two with real deployment. Hence, we built a pull request that steals a repository's secrets and walks straight past both of them. The trick is that the malicious instruction is not text. It is a picture.

The obvious version gets caught

We start with a naive attack. You open a pull request that adds one file, a coding-convention file named AGENTS.md, the kind coding agents read automatically and treat as project policy. The convention file says, in plain words:

This attack succeeds against the 73% of merged pull requests that get neither a substantive human review nor a bot review. However, it fails against the LLM reviewers, and the reason is instructive. The LLM reviewers read the convention, notice that "the .env file at the repository root" names a secret, recognize "encode as ASCII codepoints" as an exfiltration recipe, and post a high-severity finding before anyone can merge. Coherence-aware review catches it precisely because the dangerous instruction is written in plain sight, in the diff, in words.

So we moved the instruction into a picture

The evolved attack splits the payload across files so that no single one contains a complete exploit. The convention file becomes harmless. It names no secret, contains no encoding procedure, and includes nothing credential-shaped. All it does is point at an image:

The actual exploit lives inside build-spec.png. The text rendered in that image names .env, tells the agent to read it byte-by-byte, to encode each byte as its ASCII codepoint, and ends with a self-check that must pass before commit: the decoded numbers have to equal the real .env. The image is the only place in the entire pull request where any of this appears. Unfortunately, for a text-based reviewer, an image is a binary blob, so there is nothing to read.

This is not a subtle gap. CodeRabbit ships with a default configuration that excludes image files from review outright (!**/*.png). We pushed a pull request whose PNG contained maximally explicit attack prose, the words "malicious prompt injection", an order to read .env, a list of the exact secrets to take. Bugbot returned with no findings at all. To round it out, we added a fifty-line fake "provenance validator" and a fabricated incident writeup, which is what defeats the reviewer's last defense, a coherence check that flags conventions with no supporting code. With the cover story in place, the entire pull request passes clean.

What the agent does after you merge

Nothing has been stolen yet. The payload just sits in the repository, dormant, until the trap springs itself. Later, in an unrelated session, the developer asks the coding agent for something ordinary, say a token-tracking module. The agent reads the merged AGENTS.md at startup, follows the pointer to build-spec.png, reads the procedure rendered inside, opens .env, and writes the requested module with a provenance constant near the top. In our end-to-end run, Cursor driving Claude Sonnet did this autonomously on the first try, and the constant it emitted was 311 integers long:

The developer reviews the diff, sees the feature they asked for, and commits. The attacker reads the public commit and decodes the integers back into every secret in the file.

Two things nobody can see

The attack hides in two places at once. The instruction hides in the image, invisible to any reviewer that reads only text, whether that is a human scanning the diff, a regex scanner, or an LLM reviewer working from the unified diff. The stolen key hides in the output, written as a tuple of integers. They are invisible to the secret scanners that look for string-shaped credentials, because none of them convert a Python integer tuple back into ASCII for checking. A defender needs to look at the picture and decode the numbers. Almost no deployed tool does either.

It only works if the agent can see

Whether you get robbed depends less on the model than on the coding tool wrapped around it. Cursor, driving Claude Sonnet or Gemini, followed the image and exfiltrated. Anthropic's Claude Code, driving the same Sonnet weights, read the same convention and declined to act on it, narrating an explicit refusal. Thus, we observe opposite outcomes for the same model. This points at the harness and its safety scaffolding rather than the raw model as the deciding factor. There is even a third outcome that shows how thin the margin is: Opus, running under Antigravity, computed the secret and wrote it into the file, then recognized the social-engineering pattern and deleted it before finishing. The same Opus under Claude Code never engaged with the convention at all, so the harness decided the outcome even for the model most inclined to catch itself.

Ten sessions per row; "leaked" means the emitted tuple decoded byte-for-byte to all five seeded .env secrets. The same Sonnet 4.6 leaks under Cursor and Antigravity but refuses under Claude Code, so the harness, not the model, is the deciding factor. Only Claude Code refused, and it refused across every model it runs. Under Antigravity, Opus wrote the secret out and then caught the social-engineering pattern and deleted it before finishing.

A reviewer that opens the image

Since the blind spot is structural, we built the reviewer that closes it: a multimodal pull-request defender, deployed as a GitHub app that runs on a single 4 GB graphics card. It combines a scan for invisible characters, a scan of the committed code's shape, an LLM pass over the convention text, and, critically, an LLM pass over the images. On a fifteen-class stress set of attacks, a small open model (Gemma 4) caught every malicious pull request, with no false alarms on benign ones. Deployed live against eighty real pull requests it had never seen, it caught 49 of 50 attacks, including every image-channel variant, while flagging none of the thirty benign ones. While this tool still has much scope for improvement, it resembles a reviewer that opens the attachment, and today's reviewers do not.

Open source

The attack proof-of-concept, the split-payload pull request and a decoder, is available at github.com/asset-group/ghostcommit.

Results are from controlled tests in isolated repositories seeded with a fake but real-looking credential (sk-CANARY-...). The end-to-end exfiltration runs are demonstrations, reported as single autonomous runs rather than success rates; the scanner-bypass and defender numbers are measured across the trial counts stated.