Ghostcommit attack hides prompt injection in PNG to steal repo secrets via AI agents

The attack exploits the fact that AI code reviewers often skip inspecting binary files like images. The malicious instruction is steganographically embedded in a PNG file added via a pull request. The reviewer approves the change without opening the image. Later, a coding agent (e.g., one that reads all files in the repo) processes the PNG, extracts the hidden prompt, and follows it to open the repository's .env file, read every secret key, and write them into the source code as a harmless-looking list of numbers. This demonstrates a practical supply-chain attack vector for AI-assisted development workflows.