A pull request lands clean, every automated reviewer signs off, and the one thing nobody looks at twice is a PNG sitting in the diff next to a routine AGENTS.md convention file. On 11 July 2026 the ASSET Research Group, Associate Professor Sudipta Chattopadhyay and researcher Murali Ediga at the University of Missouri-Kansas City, disclosed an attack they call GhostCommit : a prompt-injection payload hidden as text rendered inside an image, not in any code a reviewer would read. The AGENTS.md file points the agent toward the picture; a text-only reviewer sees an opaque binary blob and waves the PR through, while a multimodal coding agent later opens that image, reads the instructions inside it, and copies the repository’s .env secrets out as a 311-integer ASCII tuple. It exposes something larger: the reviewer and the executor in a modern coding pipeline do not share the same senses.
A binary blob is invisible to a reviewer built for diffs
CodeRabbit’s default configuration excludes image files from review entirely, so a PNG never enters analysis, and Cursor’s Bugbot returned no findings against the payload, according to BleepingComputer’s report on the disclosure. The researchers even embedded the literal words “malicious prompt injection” inside the image, and it still sailed past both reviewers — neither tool was looking at the picture at all. A text-only reviewer isn’t fooled by GhostCommit so much as structurally incapable of seeing it, the way a spell-checker can’t flag a typo in a photograph.
The harness decided the outcome, not the model
What makes GhostCommit more than a demo: the researchers held the model constant and varied only the tool around it. BleepingComputer notes that “the tooling mattered more than the underlying AI model” — Claude Code refused to comply under every model tested, while Cursor and Antigravity leaked secrets running Sonnet, Gemini, and GPT-5.5 alike. Identical weights, opposite behavior: the safety margin was never about how cautious a model is, but what its harness lets it do once it complies. That lands at a pointed moment: the researchers’ survey of 6,480 pull requests across 300 active public repositories found 73% reached the default branch with no substantive human or bot review, the same gap that shows up as coding agents increasingly trip the same detection rules built to catch attackers while vendors race to strip out the human approval step.
The reviewer and the executor in a modern coding pipeline do not actually share the same senses.
That’s not abstract: it’s the gap between a bot that reads a diff and an agent that runs inside an editor with a developer’s own reach into the repository, its secrets, its keys. A convention file nobody double-checks, an image nobody’s reviewer opens, a merge button nobody presses by hand — each reasonable on its own, until the one thing able to act on a hidden instruction is never the thing that inspected it first.
A cheap defense exists, which is the honest complication
The researchers didn’t stop at disclosure. Their own prototype, a multimodal GitHub review app running Gemma on a single 4GB GPU, caught 49 of 50 unseen attacks with zero false positives, and Claude Code’s consistent refusal shows some harnesses already resist GhostCommit unaided. That undercuts the reading that AI code review is simply broken: the gap is narrow enough to close with modest engineering, and this remains a responsibly disclosed proof-of-concept with no evidence yet of exploitation in the wild. It’s the same shape of problem Open VSX’s registry gap exposed one layer down the coding-agent supply chain — a trust boundary nobody had secured, not proof the idea was hopeless. Still, a research prototype’s fix isn’t a fix every default has shipped — CodeRabbit excluding images was a choice, not an oversight.
That is the deeper story GhostCommit tells, one Pipeline has been circling as code review keeps relocating rather than disappearing : the question was never whether AI reviews code as well as a human, but whether the reviewer and the thing reviewed are looking at the same object at all. Until every file in a PR is read by something with the same senses as whatever runs it, a clean review is a photograph of the code, not the code itself — and a photograph can’t show what’s hidden in a different picture entirely.
