DossierENTITY

Ghostcommit

Coverage of Ghostcommit in the Nexus archive.

Earliest in view: Jul 11 · 09:03 UTCMost recent: Jul 11 · 09:03 UTC

Co-mentioned in this coverage

Recent coverage

SECURITYJul 11 · 09:03 UTCBLEEPING COMPUTER
'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets
A technique called 'Ghostcommit' uses images to hide prompt injections, bypassing AI code reviewers like CodeRabbit and Bugbot. It exploits coding agents to extract secrets from a repo's .env file and encode them as numbers in code.