--- title: This PNG Can Attack AI Coding Agents | daily.dev description: A proof-of-concept called 'ghost commit' demonstrates how a PNG image can embed hidden text instructions that vision-capable AI coding agents will execute. In... canonical: https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This PNG Can Attack AI Coding Agents | daily.dev og:description: A proof-of-concept called 'ghost commit' demonstrates how a PNG image can embed hidden text instructions that vision-capable AI coding agents will execute. In... og:url: https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1 og:image: https://api.daily.dev/og/posts/X7EHvfOT1.png og:image:alt: This PNG Can Attack AI Coding Agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This PNG Can Attack AI Coding Agents **[Coding with Lewis](https://daily.dev/sources/codingwithlewis)** · 1 min read · 1 upvotes · 0 comments ## Summary A proof-of-concept called 'ghost commit' demonstrates how a PNG image can embed hidden text instructions that vision-capable AI coding agents will execute. In the demo, a project file directs an agent to inspect a build diagram, but the image contains concealed instructions that cause the agent to open a planted environment file, disguise its contents as numbers, and inject them into a normal code change. While no real systems were breached, the research highlights that AI coding agents treating images as executable instructions significantly expands the attack surface for code review. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can a PNG image contain hidden instructions that manipulate an AI coding agent? Yes, a proof-of-concept called ghost commit embedded hidden text inside an ordinary-looking build diagram PNG. Some vision-capable coding agents read the hidden instruction and acted on it, opening a planted environment file and inserting its disguised numeric content into an otherwise normal code change, while other agents refused the instruction. _Developers adopting vision-capable coding agents can follow emerging prompt injection risks like this on daily.dev._ ### Has the ghost commit image-based prompt injection attack been used against a real company? No, the researchers only tested the ghost commit technique inside repositories they controlled themselves, so no real company was breached. It remains a proof-of-concept demonstrating that images can carry hidden instructions to AI coding agents rather than a confirmed real-world exploit. _Teams evaluating AI agent security risks can track how proof-of-concept attacks like this evolve via daily.dev._ ## Similar posts on daily.dev - [Ghostcommit attack hides malicious AI instructions in images](https://daily.dev/posts/ghostcommit-attack-hides-malicious-ai-instructions-in-images-rchpgmoi7) · Security Boulevard · 4 upvotes · 1 comments - ['Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets](https://daily.dev/posts/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets-tpklxuctc) · BleepingComputer · 2 upvotes · 0 comments - [AI Security Incident Case: Ghostcommit Attack Leveraged Images to Steal Secrets](https://daily.dev/posts/ai-security-incident-case-ghostcommit-attack-leveraged-images-to-steal-secrets-chcx3kwno) · Security Boulevard · 1 upvotes · 0 comments - [AI coding agents leaked 13,000 screenshots, and nobody hacked them.](https://daily.dev/posts/ai-coding-agents-leaked-13-000-screenshots-and-nobody-hacked-them--zsjjjpxp1) · The New Stack · 0 upvotes · 2 comments - [New attack lets hackers plant hidden instructions in AI memory with a single prompt](https://daily.dev/posts/new-attack-lets-hackers-plant-hidden-instructions-in-ai-memory-with-a-single-prompt-m5onlbsa9) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This PNG Can Attack AI Coding Agents","url":"https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1"},"datePublished":"2026-07-24T16:13:40.216Z","dateModified":"2026-09-13T21:19:41.721Z","description":"A proof-of-concept called 'ghost commit' demonstrates how a PNG image can embed hidden text instructions that vision-capable AI coding agents will execute. In...","image":"https://i.ytimg.com/vi/VYWKb91jSWw/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/VYWKb91jSWw/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Coding with Lewis","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Coding with Lewis","logo":"https://media.daily.dev/image/upload/s--St-eJIdL--/f_auto/v1728073102/logos/codingwithlewis","url":"https://daily.dev/sources/codingwithlewis"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection","timeRequired":"PT1M","video":{"@type":"VideoObject","name":"This PNG Can Attack AI Coding Agents","description":"A proof-of-concept called 'ghost commit' demonstrates how a PNG image can embed hidden text instructions that vision-capable AI coding agents will execute. In...","thumbnailUrl":"https://i.ytimg.com/vi/VYWKb91jSWw/sddefault.jpg","uploadDate":"2026-07-24T16:13:40.216Z","duration":"PT1M","url":"https://api.daily.dev/r/X7EHvfOT1","embedUrl":"https://www.youtube.com/embed/VYWKb91jSWw"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Coding with Lewis","item":"https://daily.dev/sources/codingwithlewis"},{"@type":"ListItem","position":3,"name":"This PNG Can Attack AI Coding Agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-png-can-attack-ai-coding-agents-x7ehvfot1#faq","mainEntity":[{"@type":"Question","name":"Can a PNG image contain hidden instructions that manipulate an AI coding agent?","acceptedAnswer":{"@type":"Answer","text":"Yes, a proof-of-concept called ghost commit embedded hidden text inside an ordinary-looking build diagram PNG. Some vision-capable coding agents read the hidden instruction and acted on it, opening a planted environment file and inserting its disguised numeric content into an otherwise normal code change, while other agents refused the instruction. Developers adopting vision-capable coding agents can follow emerging prompt injection risks like this on daily.dev."}},{"@type":"Question","name":"Has the ghost commit image-based prompt injection attack been used against a real company?","acceptedAnswer":{"@type":"Answer","text":"No, the researchers only tested the ghost commit technique inside repositories they controlled themselves, so no real company was breached. It remains a proof-of-concept demonstrating that images can carry hidden instructions to AI coding agents rather than a confirmed real-world exploit. Teams evaluating AI agent security risks can track how proof-of-concept attacks like this evolve via daily.dev."}}]} ```