Welcome to this week’s edition.

When people talk about input validation for AI systems, they usually think about prompts, documents, API responses, emails, tickets or config files.

But there is one input type almost nobody checks properly:

Images.

And that is becoming a real problem.

Because modern AI agents are not just reading text anymore.

They can read screenshots, diagrams, PDFs, images, charts & repository assets.

That means a PNG is no longer just a PNG.

For a vision-capable agent, it can become instructions.

Let’s get into it ~

Researchers recently demonstrated a proof-of-concept attack called Ghostcommit.

The idea is simple.

An attacker opens a pull request with normal-looking files.

For example:

The AI code reviewer sees the PR.

But the reviewer does not inspect the image properly.

To the reviewer, the PNG is basically a binary blob.

So the PR looks clean.

Nothing suspicious shows up in the text diff.

The change gets merged.

That is phase one.

Hours or days later, a developer starts working in the repository with a vision-capable coding agent.

Now the situation changes.

The code reviewer was blind to the image.

But the coding agent is not.

The agent reads the PNG, sees the hidden instruction & treats it like context.

In the demo, the instruction told the agent to read secrets from a .env file and write them back in an obfuscated format, like a list of numbers.

Looks harmless for now, but the attacker can decode those numbers back into the original secrets, which is quite genius.

People may call this steganography, but that is not exactly what is happening here.

Classic steganography hides data inside pixel values using a shared encoding scheme.

The receiver needs to know how to extract it.

This attack is simpler.

The image contains instructions that a vision-capable AI can read.

The reviewer AI does not check it while the coding agent does.

Basically one AI is blind, another AI is not.

And the attacker abuses the gap between them.

This is basically prompt injection with a different input format.

Instead of hiding malicious instructions in:

the attacker hides it in an image.

The principle is the same:

Untrusted input reaches an AI agent.

The AI agent interprets it as instructions.

The agent has access to tools, files or secrets.

Bad things happen.

That is why I keep saying prompt injection is becoming the 2026 version of SQL injection.

Back then, the interpreter was a database.

The payload was a query.

Now, the interpreter is an AI agent.

The payload can be a prompt, document, website, email or image.

Same core lesson:

Do not let untrusted input reach an interpreter without validation.

The fix is not magic.

It is the same security lesson we learned from older injection attacks:

Validate input before the interpreter sees it.

For AI agents, that means validating more than text.

You need to check:

Ask simple questions:

Where did this file come from?

Was this file expected?

Does this repo need this image?

Should an image be allowed to contain instructions?

Will any AI agent read this later?

Can this file influence an agent with tool access?

If yes, treat it as untrusted input.

If your team uses AI coding agents, start with these controls:

The goal is to stop treating every file as safe context.

Because for agents, context is executable influence.

This one is academic for now.

But it will show up in the wild.

Enough teams already run blind AI reviewers in front of vision-capable coding agents.

And that creates a weird security gap:

So next time you think about AI input validation, do not stop at text.

Because the future of prompt injection will not always look like a prompt.

Sometimes it will look like a harmless PNG in a pull request.

That’s it for this week.

Check out my previous newsletter articles for more AI security tips.

See you in the next one.

–Rami