Summary
On July 11, 2026, researchers disclosed Ghostcommit, a novel attack technique that exploits a blind spot in AI-assisted software development workflows. The attack exfiltrates sensitive .env file contents by embedding malicious instructions within images embedded in pull requests.
AI coding assistants routinely process pull request content, including embedded images, to generate summaries and security reviews. Ghostcommit exploits this behavior by encoding secret-exfiltration instructions inside image metadata or steganographic payloads. Because both human reviewers and automated AI tools typically skip image inspection, the malicious payload reaches CI/CD pipelines undetected, where it can harvest credentials, API keys, and secrets from developer workstations.
This represents a new class of supply-chain-adjacent attacks targeting the growing adoption of AI-assisted development tools. As organizations increasingly rely on AI coding assistants, the attack surface expands beyond traditional code review into the multimodal inputs these tools process.
Source
Security Boulevard — AI Security Incident: Ghostcommit
Commentary
Ghostcommit is a clever attack that highlights an often-overlooked reality: AI-assisted development tools are not just reading code — they’re processing images, attachments, and multimodal content. The assumption that “AI tools only look at code” is becoming dangerously outdated.
For red teams, this opens a new attack vector: craft malicious pull requests with steganographic payloads in images and watch how AI coding assistants handle them. For blue teams, the fix is straightforward but often ignored — enable image inspection in CI/CD pipelines and treat all AI-assisted tool outputs with the same suspicion as untrusted input. The attack doesn’t require compromising any infrastructure; it just requires developers to trust their AI tools with everything they feed them.