Ghostcommit and the reviewers that don't open the PNG

An AI code reviewer that never opens image files still can’t skip a pull request that adds one. Researchers demonstrating a technique they’ve named Ghostcommit put a prompt injection inside a PNG, pushed it as part of a normal-looking commit, and watched CodeRabbit and Bugbot wave the change through without ever parsing the image at all. A coding agent then picked up the merged review, opened the picture, obeyed the instructions written into it, and pasted the repository’s .env file back into the same codebase as an encoded list of integers.

That is a familiar shape. A gatekeeper waves through a file it treats as opaque; a piece of software downstream of the gatekeeper does not treat that file as opaque. The interesting part of Ghostcommit isn’t the specific prompt inside the PNG. It’s the shape of the review layer, which has been sold to a lot of teams over the last eighteen months as a substitute for the read-it-yourself version of code review, and which — in this specific and easily reproducible case — was substituting itself for a review it wasn’t actually doing.

Analysis, not incident reporting. No CVE has been assigned to Ghostcommit and no specific customer breach has been publicly attributed to it; the technique is a demonstrated attack pattern rather than a vendor advisory. What follows is commentary on what the demonstration exposes about the AI-code-review layer, not a walkthrough of the technique or a fix guide. Readers who want the full mechanical detail should go to the researchers’ own writeup via the BleepingComputer link above.

The same mistake, different decade

Trust a file type your inspection layer doesn’t parse and something downstream will parse it for you. The mid-2000s version of this was an email gateway that scanned message bodies but not attachments and a mail client that would happily run macros in the attachment. The late-2000s version was a web application firewall that scanned request bodies but not multipart uploads and an image parser that would happily crash on a malformed JPEG. The 2020s version, per Ghostcommit, is an AI code reviewer that scans text diffs but not image files and a downstream coding agent that will happily open the PNG for you and act on whatever it finds inside.

The distance between those three scenarios is smaller than the marketing gap between the tools that produced them.

What the demonstration is actually asking

If a team is using CodeRabbit, Bugbot, or any AI reviewer whose scope is text diffs and whose downstream coding agent has broader file-open reach than the reviewer does, the practical takeaway is smaller than the technique’s name makes it sound. It isn’t that the tools are dangerous in the abstract. It’s that the tools are answering a question — “does this diff look OK to a language model that reads text?” — that is a subset of the question a human reviewer would ask: “is anything in this commit going to run on production, and does the review process actually look at everything a downstream automated step will look at?” The gap between those two questions is the space Ghostcommit is standing in.

There is a related pattern worth naming here. The GhostApproval symlink work Wiz published on 2026-07-09 landed in the same window and turned on the same premise: an assumption baked into a coding assistant about which files it should read got quietly extended by a file the assistant didn’t recognize as a shortcut into something outside its intended scope. Different filesystem primitive, same underlying assumption failure.

Where the pattern comes from

Reviewing the gap between “what the automation checks” and “what the automation authorizes downstream” is not glamorous work. It sits closer to the audit of what actually gets read on a pull request than to the choice of which AI tool sits on top of the pipeline. That is the audit most teams skipped when they wired the AI reviewer in — the pitch was that the reviewer meant less of that work would need doing, and the pitch was, in the narrow sense, true: less of it did need doing, right up until an attacker figured out which parts had stopped being done. The change to the review process is where the change to the threat model happened; the announcement of a new class of attack is a decent reminder to look at it.

For the mechanical specifics on how the researchers assembled the payload and any vendor response, the BleepingComputer writeup has the depth. The version of the story worth carrying past the news cycle is the older one underneath it: something up the pipeline waved a file through because it never opened it, and something further down opened it anyway. Nothing about the AI part of that sentence changes the pattern.