Researchers from ASSET Research Group have introduced Ghostcommit — a new attack method that uses hidden prompt injections in PNG images to deceive multimodal AI agents and steal sensitive data from development environments.
What happened
Attackers embed malicious instructions directly into graphic files that AI agents read as visual content. During the research, it was discovered that the Cursor agent is vulnerable to such an attack: it can read instructions from an image, extract secrets from .env files, and write them into the source code as plain lists of numbers. Meanwhile, Anthropic Claude Code demonstrated resilience to this vector.
Context
The problem lies in the fact that modern multimodal models process visual content without passing through standard code security verification filters. This creates a blind spot in the workflow, where visual inputs can carry hidden commands that are granted access by the execution environment (harness) or IDE.
Why it matters for the industry
The attack shifts the security focus from the quality of the LLMs themselves to the security of the tools and infrastructure (IDEs, agents) that provide models with access to the file system. This highlights the need to implement new sandboxing standards and tools for scanning multimodal content for injections before processing.
Why it matters for users
Developers using AI assistants should exercise increased caution when working with external pull requests containing new images or files like AGENTS.md. It is important to control agent access rights to sensitive files and secrets in the local environment.
Sources
Author
Look at AI, Editorial Team