Malicious PNGs Can Bypass AI Code Reviews
gastao_s_s · reddit · 2026-07-14
Ghostcommit: Bypassing AI Code Reviews with Malicious PNGs
This post outlines a novel supply chain attack dubbed Ghostcommit. Attackers split instructions into two parts: a text rules file (like AGENTS.md) instructs the AI to read an image asset (like build-spec.png), while the actual malicious prompt is hidden within the image's pixels.
How it Bypasses Detection
- Many automated code review tools scan text but fail to parse text hidden within binary image pixels.
- Consequently, malicious PRs containing image-based instructions can pass security checks and be merged.
- Once a local, vision-capable AI agent reads the image, it can extract sensitive information like .env keys and exfiltrate them disguised as standard arrays.
Recommended Defenses
- Disable vision capabilities in automated pipelines.
- Implement sandboxing for execution environments.
- Apply stricter constraints to input boundaries.
Related event: Ghostcommit Attack Hides Prompts in PNGs to Bypass AI Code Review(2 posts)→
More from coding & agent
- LangChain and Tavily to co-host NYC event on production agents using live web data, Nov 12 — LangChain · 2026-10-26
- Dev hacks reMarkable e-ink tablet to let Opus draw and animate — Stefania_druga · 2026-10-26
- Godot games are trivially decompilable — compile C# to native DLL for real protection — mflux · 2026-10-26
- Techhalla shares full 2D-to-3D workflow with Opus 5.5 and Kling 4.0 prompts — techhalla · 2026-10-26
- Jason Furman: Building Econvitals pre-AI would need ~50 people, 3 years, $20M — HarrySurden · 2026-10-26
- Dev dictates to Claude Code for 4+ hours while riding indoor bike in aero position — jacob_posel · 2026-10-26