The AI Tool Your Developers Love Has a Blind Spot Attackers Already Found

Your engineering team almost certainly uses AI coding assistants. Gartner predicted in 2024 that 75 percent of enterprise software engineers would use them by 2028 — and by most measures, we arrived early. These tools write code, review pull requests, and accelerate delivery timelines in ways that make CFOs smile.

Here is the part that should make boards nervous: researchers just demonstrated that a single image file — a PNG — can trick these AI assistants into stealing your company's secrets. And the code reviewers, both human and AI, never noticed.

What Happened

On July 11, 2026, researchers from the University of Missouri-Kansas City's ASSET Research Group published a proof-of-concept attack they call GhostCommit. Associate professor Sudipta Chattopadhyay and researcher Murali Ediga showed how an attacker can hide malicious instructions inside a PNG image, embed it in a code repository, and wait for an AI coding assistant to follow those instructions — reading sensitive credentials and encoding them into the source code as an innocent-looking list of numbers.

The attack exploits a structural blind spot. When a pull request arrives for code review, neither human reviewers nor AI-powered review bots open image files. They treat images as binary blobs and skip them entirely. The AI code review tool CodeRabbit, for example, excludes image files from review by default. Another tool, Bugbot, returned no findings — even when the researchers embedded the words "malicious prompt injection" in plain text inside the PNG.

The theft happens later, in an unrelated session, when a developer asks the coding agent for something routine — say, a token-tracking module. The agent reads the project's convention file, follows the pointer to the image, opens the repository's .env credentials file, and writes the requested module with a "provenance" constant near the top. In one end-to-end run, the coding tool Cursor, running Anthropic's Claude Sonnet model, did this on the first try. The constant it produced — 311 integers — decoded byte-for-byte to the entire contents of the .env file. Secret scanners never caught it because none of them convert a Python integer tuple back into ASCII.

The Review Gap Is Wider Than You Think

The researchers surveyed 6,480 pull requests across the 300 most active public repositories over the prior 90 days. Their finding: 73 percent of merged pull requests reached the default branch with no substantive human review and no bot review at all.

That gap is where GhostCommit lives. Organizations are adopting AI coding tools faster than they are building governance around them. The tooling matters more than the model: the same AI model that leaked secrets through Cursor refused outright when run through Anthropic's Claude Code, which has different runtime guardrails. Same weights, opposite outcomes — decided entirely by the safety harness wrapped around the model.

Why This Is a Board-Level Problem

In Cyber Risk Is Business Risk, I wrote about the Three Questions framework that every board should be asking: What are our most critical assets? What are we doing to protect them? How do we know it is working?

GhostCommit forces a pointed version of those questions for any organization adopting AI development tools:

What are our most critical assets? Your source code repositories hold API keys, database credentials, and service tokens that are the keys to your digital kingdom. If an AI assistant can be tricked into reading and exfiltrating those credentials, the blast radius is not a single laptop — it is every system those credentials unlock.

What are we doing to protect them? Most organizations rely on code review as a control. But if 73 percent of pull requests get no meaningful review, and the AI reviewers themselves skip entire categories of files, the control is not functioning. This is the compliance-versus-security tension I return to throughout the book: checking the box on "we do code review" is not the same as verifying that code review catches what matters.

How do we know it is working? The GhostCommit researchers built a multimodal pull-request defender — essentially a reviewer that opens the attachment — and tested it against 80 pull requests it had not seen before. Only one attack got past it, and none of the 30 legitimate pull requests triggered a false alarm. The technology to close this gap exists. The question is whether your organization has deployed it.

What to Ask Your CISO This Week

If your organization uses AI coding assistants — and the odds are strong that it does — here are the conversations to start immediately:

1. Do we have an AI tooling inventory? You cannot govern what you cannot see. Shadow adoption of AI coding tools is rampant. Your developers may be using tools your security team has not evaluated, approved, or configured.

2. What guardrails are on our AI coding tools? The GhostCommit research showed that the tooling wrapper matters more than the underlying AI model. Ask whether your approved tools have runtime protections that prevent agents from accessing credential files without explicit authorization.

3. Does our code review process cover all file types? If your review tools skip images, archives, or other binary files by default, you have a gap. Multimodal review — where the reviewer actually inspects what is in non-code files — is no longer optional.

4. Are credentials still stored in code repositories? The best defense against credential theft from a repository is not having credentials in the repository. Secrets management solutions exist. If your .env files still contain production keys, GhostCommit is one of many reasons to accelerate that migration.

The Bigger Picture

GhostCommit is not an isolated curiosity. It is the latest evidence that the AI tools accelerating your business are also expanding your attack surface. This is not a reason to abandon AI — it is a reason to govern it. The organizations that will thrive are the ones that treat AI adoption as a risk management exercise, not just a productivity play.

Every new capability your developers gain, your attackers gain too. The difference is whether your board is asking the right questions before the next GhostCommit variant arrives in a pull request your team never reviews.