Unverified50% confidenceFactExact time
Ghostcommit将恶意的自然语言指令隐藏在PNG图片的像素之中，而非隐藏可执行的恶意代码
1
Sources
50%
Confidence
Long-term
Relevance
7/15/2026
First Seen
Sources
Related Claims
UnverifiedGhostcommit是典型的间接提示词注入攻击，将注入载体从纯文本升级到图像像素层面78% similarUnverifiedGhostty is written in the Zig language, uses a GPU-accelerated rendering pipeline, and achieves efficient rendering on macOS using the Metal graphics API.66% similarUnverified恶意指令被渲染成文字绘制在PNG图片中，通过AI代理的OCR或视觉理解能力被识别并作为Prompt指令执行62% similarUnverifiedA developer's ThumbAPI successfully generated images on a local Mac, but silently failed and returned IMAGE_OTHER on a Hetzner production environment using the same code, API key, and prompt.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/514305API
curl https://kongchang.com/api/v1/knowledge/claims/514305MCP
get_claim(id=514305)