In October 2026, the security community disclosed a new attack pattern called Ghostcommit: malicious instructions are stashed inside a PNG image, and an AI coding assistant — a tool that can automatically read and write code — reads the image, encodes repository secrets as numbers, mixes them into code, and pushes them to the public. Reviewers like CodeRabbit don't scan images, so they let it straight through. We read it this way: the more an AI reads, the wider its attack surface grows — and reviewers can't even see it.
In the same window, related vulnerabilities including GitSpawn, Plugin4Shell, and GhostApproval were disclosed, hitting vendors such as Amazon, Google, Anthropic, and Cursor; some remain unpatched. The essence of the attack: Agents proactively swallow large amounts of context (images, docs, configs) to understand a project, but they can't tell project assets apart from commands smuggled in. Traditional sandbox boundaries no longer hold.
What this is
Ghostcommit is not a single bug — it's a class of attack pattern: hide malicious prompts inside file types the Agent will proactively read — PNGs, .git/config, plugin repositories, symlinks — and make it execute instructions without "realizing" it. The attacker only needs to fool the AI that's reading code on your behalf.
Paths already demonstrated in the wild: inject abnormal fields into .git/config so the Agent runs a malicious program when executing git status; swap in poisoned code during plugin updates using a same-named branch; use symlinks so the approval dialog displays one file while writing to another. Multiple enterprise IDE (integrated development environment) builds are also in scope.
Industry view
The mainstream vendor response is patching: Claude Code 2.1.196 closed the GitSpawn channel, and Codex CLI 0.149.0 also plugged the gap. But Wiz researchers point out this is a tax on the Agent's design philosophy — the more context it reads, the smarter it gets, and the higher the chance of being steered off course. Version bumps alone won't block every variant.
A sharper critique comes from the independent developer community, which is questioning why major vendors still haven't clearly explained that "trusting a folder" is equivalent to "granting it code execution rights." Author Guanhuang's read is more direct: AI coding tools aren't unusable — they need to be treated as "a capable but naive new colleague." The governance priority isn't prohibition; it's boundaries.
Counter-arguments deserve a hearing: throwing every unfamiliar repo into a VM adds cost and is unrealistic for solo freelancers. "Security here isn't about who's smarter — it's about who survives one more hassle." That's the pragmatic compromise when there's no better answer.
Impact on regular people
For enterprise IT: If your team uses AI coding assistants, you need to re-audit the code submission flow — .env files and SSH private keys must not sit inside the working directory.
For working professionals: Developers need to run unfamiliar repos and AI-generated projects in isolated environments first. It's an extra step, but for long-term freelancers it's a necessary cost.
For consumer markets: In the short term, ordinary users won't feel much — but once AI programming tools enter the enterprise, "security boundaries" may become a billable line item in service delivery.