Malicious PNGs Can Bypass AI Code Reviews
gastao_s_s · reddit · 2026-07-14
## Ghostcommit: Bypassing AI Code Reviews with Malicious PNGs This post outlines a novel supply chain attack dubbed **Ghostcommit**. Attackers split instructions into two parts: a text rules file (like `AGENTS.md`) instructs the AI to read an image asset (like `build-spec.png`), while the actual malicious prompt is hidden within the image's pixels. ## How it Bypasses Detection - Many automated code review tools scan text but fail to parse text hidden within binary image pixels. - Consequently, malicious PRs containing image-based instructions can pass security checks and be merged. - Once a local, vision-capable AI agent reads the image, it can extract sensitive information like `.env` keys and exfiltrate them disguised as standard arrays. ## Recommended Defenses - Disable vision capabilities in automated pipelines. - Implement sandboxing for execution environments. - Apply stricter constraints to input boundaries.
Related event: Ghostcommit Attack Hides Prompts in PNGs to Bypass AI Code Review(2 posts)→
More from coding & agent
- Codex turns out 123 screensavers in one playful batch — intellectronica · 2026-07-21
- Grok Build adds `grok doctor`, resumable sessions and remote image paste — mark_k · 2026-07-21
- Autoresearch proposes packaging ML runs as studies with questions, analysis, and code diffs — morgymcg · 2026-07-21
- CHAP defines approvals, handoffs, and audit logs for human-agent workflows — DeliveryTechnical199 · 2026-07-21
- The author says Codex reached 20x and is now debugging spec decoding on a hybrid parallel setup — TheZachMueller · 2026-07-21
- Axcess adds an MCP connector for WCAG accessibility checks that scanners miss — modelcontextprotocol · 2026-07-21