Why it matters
ASSET Research Group hid a prompt-injection payload in a PNG referenced by an apparently benign AGENTS.md file. Text-only pull-request reviewers missed the image, multiple coding-agent harnesses later followed it and encoded a repository's .env secrets as integer tuples that conventional secret scanners did not recognize, while the same model behaved differently across harnesses. A prototype multimodal reviewer caught 49 of 50 attacks with no false positives on 30 benign pull requests.
My takeaway: Review every agent-readable artifact, including images and instruction files, before merge; treat repository policy files as executable control inputs; decode non-string data flows in secret scanning; and test model-plus-harness combinations because wrapper behavior can dominate model behavior.