Malicious PNGs Can Bypass AI Code Reviews
gastao_s_s · reddit · 2026-07-14
Ghostcommit: Bypassing AI Code Reviews with Malicious PNGs
This post outlines a novel supply chain attack dubbed Ghostcommit. Attackers split instructions into two parts: a text rules file (like AGENTS.md) instructs the AI to read an image asset (like build-spec.png), while the actual malicious prompt is hidden within the image's pixels.
How it Bypasses Detection
- Many automated code review tools scan text but fail to parse text hidden within binary image pixels.
- Consequently, malicious PRs containing image-based instructions can pass security checks and be merged.
- Once a local, vision-capable AI agent reads the image, it can extract sensitive information like .env keys and exfiltrate them disguised as standard arrays.
Recommended Defenses
- Disable vision capabilities in automated pipelines.
- Implement sandboxing for execution environments.
- Apply stricter constraints to input boundaries.
Related event: Ghostcommit Attack Hides Prompts in PNGs to Bypass AI Code Review(2 posts)→
More from coding & agent
- First-ever Three.js Conference lands in Paris, with a panel on AI-shortened design workflows — OdinLovis · 2026-09-11
- Data engineering, not agent frameworks, is the real bottleneck for enterprise AI agents — dhruv2038 · 2026-09-11
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11
- Investment Analyst Asks How to Build a Claude-Based Diligence Agent Stack — Careless_Tie2286 · 2026-09-11
- Treating agents like 50 First Dates: a 3-layer context system so every conversation doesn't start from zero — evielync · 2026-09-11
- Running the Firefox MCP on Android via Termux, ngrok, and mcp-proxy — Nervous-Strain7544 · 2026-09-11