AI reviewers defeated by a PNG image

Because we insisted on outsourcing our brains to AI, we now get to deal with the Ghostcommit attack, which tricks AI coding tools by hiding prompt injections in plain PNG files. These supposedly genius reviewers treat images as simple binary blobs, letting malicious code reviews pass and happily exposing secrets from our .env files. Defending our repositories from this absolute madness requires forcing these oblivious AI agents to actually inspect image contents instead of blindly trusting them. I suppose having actual humans review code was just too old-fashioned.