The University of Missouri-Kansas City's ASSET Research Group has released further detail on the Ghostcommit technique. It hides prompt-injection instructions inside an image committed to a software repository. Automated code review skips the image; an AI coding agent reads it.
CodeRabbit excludes image files from review by default, and Bugbot returned no findings when the researchers tested it. The injected instructions can be arbitrary, including reading secrets from the repository and exposing them.
Why identity teams should care
This looks like an AppSec problem, and it is, but the blast radius is an identity one. Agents are handed credentials, repository access and the ability to take actions. An agent that can be instructed by a file it reads is a credential holder that can be instructed by an attacker.
The uncomfortable part is that none of the usual controls engage. There is no vulnerability to patch, no malicious dependency to flag, and no anomalous login to detect. The agent authenticated correctly, used permissions it legitimately held, and did what it was told by content inside the repository it was asked to work on.
What this changes about agent permissions
Treat repository content as untrusted input to the agent. If the agent can act on what it reads, then everything it reads is an instruction channel, not just data.
Scope agent credentials to the task, not the repository. A review agent should not hold the secrets it could be persuaded to exfiltrate. If it can read your CI variables, the injection has somewhere to go.
Log what the agent did, attributably. If your coding agents share one service account, an incident like this leaves you unable to say which agent acted or on whose behalf.
This is the same underlying gap as the AI agent authorization work covered elsewhere in this issue: agents holding standing credentials with no durable link back to a human authorisation.
Source
Ghostcommit hides prompt injection in images to fool AI agents, BleepingComputer