Loading story…
Researchers disclosed Ghostcommit, a proof-of-concept software supply-chain attack that hides prompt-injection instructions inside a PNG image referenced by an AGENTS.md file, allowing malicious pull requests to appear benign during review. In the demonstrated scenario, AI code reviewers such as Cursor Bugbot and CodeRabbit did not meaningfully inspect image content, so the pull request could be merged even though the real instructions were concealed in the image rather than visible text.
After merge, the attack is triggered when a developer later asks a coding agent to perform a routine task and the agent reads the hidden image instructions, accesses repository secrets such as the .env file, encodes the contents as integer tuples, and inserts them into source code in a way that can evade typical secret scanners. Researchers from the University of Missouri-Kansas City's ASSET Research Group said exploitation depended more on the coding harness than the underlying model, with Cursor and Antigravity leaking secrets across multiple models while Claude Code consistently refused; they reported the issue to vendors and built a multimodal GitHub review app that detected nearly all tested variants, including image-based attacks, with no false positives in their evaluation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The researchers built a prototype multimodal GitHub review app to inspect images and related signals; in testing, it reportedly blocked or detected nearly all Ghostcommit attack variants with no false positives in the reported evaluation or live trial.
The researchers disclosed their Ghostcommit findings to affected vendors following their investigation.
In testing, the researchers found exploitation outcomes depended more on the coding tool or harness than the underlying model: Cursor and Antigravity leaked secrets across multiple models, while Anthropic's Claude Code consistently refused.
Researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrated Ghostcommit, a proof-of-concept supply-chain attack that hides malicious instructions in a PNG referenced by AGENTS.md so AI code reviewers miss them and coding agents later leak repository secrets such as .env contents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourceasset-group.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla’s **0DIN** researchers demonstrated a supply-chain-style proof of concept in which an AI coding agent such as **Claude Code** can be manipulated into compromising a developer’s machine while cloning and initializing a seemingly benign GitHub repository. The repository itself can appear clean, with a legitimate-looking `README` and no obviously malicious code, but a staged setup flow causes a package to fail until initialization and prompts the agent to run follow-up commands it interprets as routine recovery steps. In the demonstrated chain, an initialization script fetched attacker-controlled data from a **DNS TXT** record and executed it, with the TXT record carrying a base64-encoded reverse-shell payload that could give the attacker interactive access under the developer’s privileges. Researchers warned that such access could expose environment variables, API keys, local configuration files, source code, documents, browser sessions, passwords, and enable persistence, while remaining difficult for scanners, human reviewers, and AI agents to detect because each step appears normal in isolation. They said threat actors could distribute these repositories through fake job offers, tutorials, blog posts, or direct messages, and urged agentic tools to reveal the full execution chain, including dynamically fetched scripts and runtime code.
Jun 29, 2026
Researchers from Johns Hopkins University showed that a **"comment-and-control"** prompt injection technique could hijack AI coding agents embedded in GitHub workflows, including Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub Copilot Agent. By planting malicious instructions in untrusted GitHub content such as pull request titles, issue text, comments, and hidden HTML, the attackers made the agents follow attacker-controlled directions and exfiltrate secrets through workflow output or GitHub comments. The demonstrations reportedly exposed Anthropic and Gemini API keys, GitHub tokens, and other credentials available in GitHub Actions runners, and the affected vendors paid bug bounties and patched the issue without issuing CVEs or public advisories. Separate research also identified a trojanized PyPI package, **`hermes-px`**, marketed as a privacy-focused AI proxy but designed to steal user prompts and exfiltrate data, including an altered Claude Code system prompt. Together, the findings show that the most immediate risk around AI developer tooling is not only the model itself but the runtime and integration layer, where untrusted repository content, overprivileged CI/CD workflows, and malicious third-party packages can turn coding assistants into secret-leaking supply-chain footholds. Defenders were urged to minimize agent permissions, restrict secret exposure, rotate credentials, prefer short-lived OIDC tokens, and harden GitHub Actions configurations such as `pull_request_target` usage.
Jun 29, 2026
Researchers at Noma Security disclosed **GitLost**, a prompt injection technique that can make GitHub **Agentic Workflows** expose data from private repositories through public issue comments. In the demonstrated attack, an adversary needed only to open a crafted issue in a public repository; if the workflow had broad cross-repository read access and permission to post publicly, the agent could be steered into retrieving content from a private repository in the same organization and publishing it as part of its response. The proof of concept showed the agent reading a private repository `README` and using its own authorized access as the exfiltration path, without the attacker needing credentials, coding skills, or direct access to the private repo. Noma said GitHub had been notified through responsible disclosure and published workflow reproductions and proof-of-concept evidence after testing. The researchers also reported that GitHub’s prompt-based output protections could be bypassed with a one-word prefix—**"Additionally,"**—causing the model to comply with the malicious instruction instead of refusing it. The findings highlight an architectural risk in AI agents that combine access to sensitive internal data, ingestion of untrusted public input, and an outward publishing channel; recommended mitigations include minimizing token and repository scope, limiting what agents can publish publicly, restricting which users can trigger agent actions, and requiring human review before public posting.
Jul 11, 2026