You'll be working with a single PNG image of a ghost on a dark sky. Your job is to inject a directive into the image that makes the simulated AI code-review agent (GhostBot) leak the repository's payment key — and post it as a public PR comment.
Each level hides the text one layer deeper (metadata → visible text → tiny text → color-blended → encoded payloads). And the bot gets harder to exploit: it refuses targeted asks, masks what it shows, and scatters what it leaks. Finding the injection is half the lab — reading the leak is the other half.
tEXt chunk into the PNG. GhostBot reads it as part of image processing.In July 2026, the ASSET Research Group disclosed a class of multimodal prompt-injection attacks where prompt-injection instructions are hidden inside PNG image files referenced from repository policy files (such as AGENTS.md). When an AI code-review agent ingests the PNG — through metadata extraction, visual text recognition, or steganographic decoding — the hidden instruction enters the agent's context window alongside its system prompt. The agent processes the injected instruction as if it were a legitimate directive, leading to secret exfiltration, unauthorized tool use, or policy bypass.
The attack class is significant because it exploits the image-processing pipeline as an injection surface. Traditional prompt-injection defenses focus on text input; multimodal attacks bypass these defenses by entering through a non-text channel that the AI processes automatically.
GhostBot here is a teaching stand-in for a real AI code-review agent. In the real disclosure, the bot was tricked into reading .env and posting secrets — disguised as integer constants to evade string-based secret scanners — as a public PR comment.