Ghostcommit: Supply Chain Attack Bypassing AI Code Review via Image Steganography

Vulnerability Overview Vulnerability Name: Ghostcommit Attack Description: A new supply chain attack method that bypasses AI code review tools by injecting malicious prompts hidden within PNG images, tricking code agents into leaking sensitive information such as configuration files. Impact Scope Affected Tools: Cursor, Antigravity, Claude Code platform, etc. Affected Models: Claude Sonnet 4.6, Composers-2, GPT-5.5, Gemini 3.1 Pro, Gemini 3 Flash, etc. Attack Mechanism: The attack is triggered during code merges. When developers initiate routine feature development requests in other sessions, the attack chain activates. The agent reads the merged document, parses the target image according to instructions, reads the local file, and generates module-level constants (e.g., ) as hundreds-of-digit number tuples. Decoding this number sequence byte-by-byte reveals the complete plaintext content of the file. Remediation Custom Defense Detection Solution: A multimodal GitHub code review prototype tool was developed based on the lightweight open-source large model Gemma 4, requiring only a single GPU with 4GB of VRAM to run. The tool integrates three detection capabilities: invisible character identification, code structure feature analysis, and synchronous large model verification of normative documents and embedded images. Stress Test Performance: Achieved full interception of 15 types of attack samples with low false positives. Among 80 unknown real-world test samples, 50 attacks were detected (49 successfully intercepted), and all image steganography variants were identified. No false positives were recorded among 30 normal business submissions. POC Code Summary The Ghostcommit attack bypasses AI code review tools by hiding malicious prompts within images, leading to sensitive information leakage. The primary victims are various code agents and models. The remediation strategy includes a custom defense detection solution, utilizing a multimodal code review tool for comprehensive detection, which effectively intercepts attacks and minimizes false positives.

Goal Reached Thanks to every supporter — we hit 100%!

Ghostcommit: Supply Chain Attack Bypassing AI Code Review via Image Steganography