Ghostcommit: Detecting AI Agent Prompt Injection and Data Exfiltration via Image Steganography

The integration of AI agents into the software development lifecycle has introduced a novel attack surface that traditional security controls are ill-equipped to handle. The "Ghostcommit" technique, recently demonstrated against platforms like CodeRabbit and Bugbot, highlights a critical vulnerability in how these agents process multimodal inputs.

By leveraging steganography to hide prompt injections within PNG image files, attackers can bypass standard static analysis and code review filters. Once an AI agent processes the malicious image, it can be manipulated to read sensitive environment files (e.g., .env) and exfiltrate secrets by encoding them directly into source code commits. This effectively turns a helpful coding assistant into an insider threat, capable of leaking credentials in a manner that appears legitimate to automated validators.

Technical Analysis

Affected Products and Platforms

AI Code Reviewers: CodeRabbit, Bugbot (confirmed as bypassed in the PoC).
Target Agents: General-purpose AI coding assistants capable of processing image inputs and performing file operations.
Platform: Cloud-based repository management systems (GitHub, GitLab) utilizing AI integrations.

Attack Mechanics The attack chain leverages the multimodal nature of modern Large Language Models (LLMs):

Injection: The attacker commits a PNG file to the repository. While the file may appear benign (e.g., a diagram or screenshot), it contains a hidden prompt injection embedded via steganography (metadata or pixel manipulation).
Evasion: Traditional AI code reviewers that analyze text diffs fail to detect the threat because they do not "open" or process the image content.
Execution: A downstream AI coding agent, tasked with analyzing the repository or processing the image, parses the visual data. The hidden instruction overrides the system prompt.
Exfiltration: Following the malicious instruction, the agent reads the repository's .env file. It then obfuscates the stolen secrets (API keys, database strings) and writes them into the codebase as a list of numbers or benign-looking variable assignments.

Exploitation Status Currently, Ghostcommit is a proven Proof of Concept (PoC) demonstrated by researchers. It highlights a fundamental weakness in how AI agents handle file permissions and untrusted inputs. There are no specific CVEs assigned for this technique as it represents a logical bypass of agent safety filters rather than a buffer overflow or traditional software vulnerability.

Detection & Response

Detecting Ghostcommit requires a shift from looking for known malware signatures to monitoring the behavior of automation tools. Defenders must monitor for anomalous file access patterns by AI agents and the sudden appearance of high-entropy data in source files.

Sigma Rules

YAML

---
title: Potential AI Agent Accessing Sensitive Environment Files
id: 8a4b2c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects script interpreters or known AI agent binaries accessing .env files, a behavior indicative of data harvesting in Ghostcommit attacks.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\java.exe'
      - '\coderabbit.exe'
      - '\bugbot.exe'
    CommandLine|contains:
      - '.env'
  condition: selection
falsepositives:
  - Legitimate developers debugging configuration issues
level: high
---
title: Image File Processing by Automation Tools
id: 9b5c3d2e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects automation tools or agents processing PNG files, which may contain steganographic payloads.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\java.exe'
    CommandLine|contains:
      - '.png'
      - 'image'
  filter:
    User|contains:
      - 'Admin'
      - 'Developer'
  condition: selection and not filter
falsepositives:
  - Image processing scripts run by authenticated users
level: medium
---
title: Suspicious Numerical Pattern Injection in Source Code
id: 0c6d4e3f-7a8b-6c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects processes writing large blocks of numeric data to source code files, a potential exfiltration method used by Ghostcommit.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.py'
      - '.js'
      - '.ts'
      - '.go'
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
  condition: selection
falsepositives:
  - Legitimate generation of data matrices or constants
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for script interpreters accessing .env files
DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName =~ ".env"
| where InitiatingProcessFileName in~ ("python.exe", "node.exe", "java.exe", "python3", "node")
| where ActionType == "FileAccessed"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName, FolderPath
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for processes that accessed .env files recently
SELECT 
  Process.Name as ProcessName,
  Process.Pid,
  Process.CommandLine,
  File.Path AS AccessedFile,
  System.Time AS AccessTime
FROM process_scan(ProcessList=pslist())
  JOIN foreach(row=
    SELECT FullPath
    FROM glob(globs="/.env"), 
    /* Add specific repo paths here */
  )

Remediation Script (Bash)

Bash / Shell

#!/bin/bash
# Remediation: Sanitize PNG Metadata and Scan for Ghostcommit Artifacts
# Usage: ./remediate_ghostcommit.sh /path/to/repo

REPO_PATH=$1

if [ -z "$REPO_PATH" ]; then
  echo "Usage: $0 <repository_path>"
  exit 1
fi

echo "[*] Scanning for potential Ghostcommit artifacts in $REPO_PATH..."

# Check for .env files that might have been accessed recently (example heuristic)
echo "[*] Verifying .env file permissions..."
find "$REPO_PATH" -name ".env" -exec chmod 600 {} \;

echo "[*] Stripping metadata from PNG files to remove steganographic payloads..."
# Requires exiftool
if command -v exiftool &> /dev/null; then
  find "$REPO_PATH" -type f -name "*.png" -exec exiftool -all= {} \;
  find "$REPO_PATH" -type f -name "*.png" -exec sh -c 'mv "$1" "${1%.png}.clean.png" && mv "${1%.png}.clean.png" "$1"' _ {} \;
else
  echo "[!] exiftool not found. Please install it to sanitize images."
fi

echo "[*] Remediation complete. Review git diff for unauthorized changes."

Remediation

To mitigate the risk of Ghostcommit and similar prompt injection attacks, organizations must implement strict controls around AI agent behavior and input sanitization:

Input Filtering: Configure AI code review agents and coding assistants to ignore or reject image file inputs (.png, .jpg) unless strictly necessary and processed in a sandboxed environment.
Least Privilege: Run AI agents with the minimum necessary permissions. They should not have read access to .env, secrets.yaml, or other credential stores unless explicitly required and audited.
Pre-Commit Hooks: Implement strict pre-commit hooks that block commits containing high-entropy data or suspicious numeric patterns in source code files, which are indicative of exfiltration obfuscation.
Sanitization Pipeline: Automate the stripping of metadata (EXIF, IPTC) from all images committed to repositories using tools like exiftool or ImageMagick before they are processed by CI/CD pipelines.
Vendor Coordination: Review the security configurations of AI tools like CodeRabbit and Bugbot. Ensure they have updated their prompt validation logic to resist instruction overrides hidden in non-textual data.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub