'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

A technique called 'Ghostcommit' uses images to hide prompt injections, bypassing AI code reviewers like CodeRabbit and Bugbot. It exploits coding agents to extract secrets from a repo's .env file and encode them as numbers in code.