Ghostcommit Attack Explained: How Malicious PNGs Bypass AI Code Review

A New Supply Chain Attack Targeting AI Coding Tools

As AI programming assistants become deeply embedded in development workflows — from code completion to automated Pull Request reviews — more and more teams rely on these tools to boost productivity. But behind every efficiency gain lurk new security blind spots. The Ghostcommit attack technique, recently disclosed in the developer community, exploits the multimodal capabilities of vision-enabled AI coding tools to execute a previously rare form of supply chain attack.

A supply chain attack is one where the attacker doesn't target the victim's system directly, but instead infiltrates upstream components, tools, or processes that the target depends on. Recent high-profile examples include the 2020 SolarWinds incident — where attackers planted malicious code inside software update packages, affecting tens of thousands of enterprises and government agencies — and the 2021 Codecov breach, in which attackers tampered with CI tool scripts to steal environment variables and secrets at scale. Ghostcommit follows the same playbook, but upgrades the attack vector from traditional code or scripts to multimodal content that AI agents can parse, representing the evolution of supply chain attacks into AI-native development environments.

Unlike traditional code injection, the core of Ghostcommit isn't about hiding executable malicious code — it's about hiding malicious natural language instructions in a place that's difficult for both human reviewers and automated tools to detect: the pixels of a PNG image.

How Ghostcommit Works: The Split Payload Design

What makes Ghostcommit particularly clever is its split payload design. The attack doesn't rely on a single malicious file; instead, it breaks the attack chain into two seemingly harmless parts.

Step 1: A Text Rules File Acts as the "Guide"

The attacker submits a text-based rules file to the project — something like AGENTS.md, a configuration or instruction document that AI agents read by default. This file contains no dangerous code whatsoever. Its sole purpose is to direct the AI to read another file — for example, an image asset called build-spec.png.

Modern AI coding agents (such as OpenAI Codex, Anthropic Claude's agent mode, GitHub Copilot Workspace, and others) typically scan the project directory before executing tasks, reading specific configuration or rules files to understand the project context and behavioral constraints. Files like AGENTS.md, CLAUDE.md, and .cursorrules have gradually become industry conventions — developers use them to tell AI agents about coding standards, prohibited operations, or task workflows. However, this mechanism is fundamentally a high-privilege instruction entry point: anyone who can commit files to a project can theoretically influence how the AI agent behaves by modifying these files. Ghostcommit treats this "legitimate entry point" as the first link in its attack chain. Its stealth comes from how common these files are and how innocuous their format appears.

Since the text content looks like nothing more than asking the AI to "refer to the build spec," neither human reviewers nor automated scanning tools can easily flag it as malicious.

Step 2: A PNG Image Carries the Real Malicious Instructions

The actual attack instructions are rendered as text and drawn into a PNG image. To a human, this might look like an ordinary "build flow diagram" or "configuration diagram." But to an AI agent with OCR or visual understanding capabilities, the text in the image is recognized, parsed, and executed as a prompt instruction.

Multimodal large language models (such as GPT-4V, the Claude 3 series, Gemini, etc.) build visual encoders on top of text understanding, converting image content into token sequences the model can process — including native recognition of text within images, i.e., Optical Character Recognition (OCR). Unlike traditional OCR that requires dedicated engines, modern vision-language models have this capability natively integrated: they can extract and semantically understand text from screenshots, diagrams, and even handwritten content without any additional tooling. This means an attacker simply needs to "screenshot" or "draw" instructions as an image to bypass all text-scanning-based security checks, having them parsed directly by the vision model as executable instructions.

This is a classic indirect prompt injection attack. Indirect prompt injection was systematically proposed and categorized by security researcher Kai Greshake and others in 2023. Unlike direct injection — where an attacker inputs malicious instructions directly to the model — indirect injection hides malicious instructions in third-party content that the model will actively read, such as web pages, documents, emails, or image pixels. When an AI agent automatically fetches and processes this content during task execution, the embedded malicious instructions are treated as legitimate context and executed. This attack escalates the injection vector from plain text to the image pixel level, dramatically increasing stealth and representing a further evolution of this attack class in multimodal scenarios.

Why It Bypasses AI Code Review Tools

The reason Ghostcommit succeeds comes down to a pervasive blind spot in current automated code review tools (like CodeRabbit and similar):

These tools scan text-based code, but they don't parse the pixel content inside binary image assets.

In other words, the security review boundary stops at "human-readable text." When malicious instructions are encoded into an image's pixels, they naturally fall outside the detection scope of existing review tools. A Pull Request containing such an image can sail through all security checks, get merged into the main branch — and the entire CI/CD pipeline sees nothing wrong.

This exposes a deeper problem: when AI gains multimodal capabilities, the attack surface expands to cover all modalities — yet most security tools' review logic remains stuck in a single text dimension, having not yet caught up with this shift. This is a textbook case of the plain-text-era security toolchain failing fundamentally in a multimodal context.

The Data Exfiltration Path: From Malicious Image to Leaked .env Secrets

Once the malicious PR is merged, the final link in the attack chain is activated. When a developer's local AI agent reads the project in subsequent work, the full credential theft flow proceeds as follows:

1. The AI agent follows AGENTS.md's instructions and reads the PNG image;
2. The vision model parses the hidden instructions embedded in the image;
3. The instructions direct the agent to extract sensitive local files — such as API keys and database credentials from .env;
4. The stolen secrets are encoded as seemingly innocuous arrays, disguised as normal data and exfiltrated.

The entire process requires no developer to manually run any suspicious script. The AI agent completes the data exfiltration in the course of what appears to be normal collaborative work. This is what makes this class of attack most dangerous: it turns the AI assistant itself into the attack's executor.

Hardening Your AI Development Pipeline: Three Defensive Recommendations

For multimodal supply chain attacks like Ghostcommit, the following defensive measures deserve priority implementation.

1. Disable Vision Capabilities in Automated Pipelines

For AI agents running in automated environments such as CI/CD, unless the business scenario genuinely requires it, disable their vision/image parsing capabilities. This fundamentally cuts off the "image as malicious instruction carrier" attack path and is the lowest-cost defensive measure available.

2. Sandbox AI Agent Execution Environments

Sandbox AI agent execution environments, strictly limiting their access to sensitive local files (like .env) and external networks. Sandboxing is a security technique that runs programs in a controlled, isolated environment, constraining their access to system resources, the filesystem, and the network to contain potential damage. In AI agent contexts, the "capability boundary" directly determines the blast radius of an attack. Common approaches include container isolation (e.g., Docker with seccomp policies), virtual machine isolation, and tool-call permission allowlists designed specifically for AI agents. Some AI agent frameworks (such as E2B and Modal) already provide native sandboxed execution environments that fully isolate code execution from the local filesystem. Even if malicious instructions are successfully triggered, they cannot read or exfiltrate critical credentials.

3. Enforce Strict Input Boundaries

Define clear input boundaries for the types and sources of files an AI agent can read, with particular caution around binary assets, external images, and other non-text content — avoiding a situation where agents indiscriminately "read every file in the project." Additionally, modifications to high-privilege rules files like AGENTS.md should be subject to human review and not cleared solely by automated scanning.

Conclusion: A New AI Security Challenge in the Multimodal Era

Ghostcommit's significance as a warning isn't just about whether it gets exploited at scale — it's about the trend it reveals: every expansion of AI capability means a corresponding expansion of the attack surface.

When AI can read text, images, audio, and video, security review can no longer focus solely on code text. Development teams need to rethink two core questions: What can the AI agent read? What is the AI agent permitted to execute? Enjoying the productivity gains that AI coding delivers while designing security boundaries proactively — that is the fundamental approach to confronting this new class of multimodal threats.