AI coding assistants such as Claude are quickly becoming essential partners for developers. They review code, clarify complex functions, and generate new features from simple instructions. Yet fresh findings indicate that this reliance may also create serious vulnerabilities.

Security researchers professor Sudipta Chattopadhyay and researcher Murali Ediga have shown an attack that bypasses direct targeting of the AI. Instead it exploits elements the AI often overlooks in code reviews. Rather than embedding harmful commands in code lines, the team placed them inside an image. Because many AI review systems treat images as harmless extras, the pull request looks clean and passes inspection.

The riskiest asset may be one nobody bothers to examine

Picture a report that includes a company logo in one corner. Most people would notice it briefly then continue. Now suppose that logo held secret directions for an AI helper to access a password store during later use. This captures the core of the proof of concept. The attack does not activate right after code merges. It activates later when a developer requests an unrelated action like building a helper function. The AI has already taken in the concealed commands and may reach protected files before inserting private details into its output.

The stolen information avoids obvious placement in source code. It appears instead as routine values that match surrounding code, reducing chances that security checks or quick human reviews will spot the issue.

The issue spans beyond any single model

Tests showed results depended less on the underlying large language model and more on the coding assistant built around it. Some platforms followed the hidden directions without question while others flagged odd behavior and stopped. This difference matters because it points to a broader concern. The challenge centers on how AI coding systems choose trusted data and decide which files they may reach.

Researchers see a path forward. They recommend that AI review systems become truly multimodal by applying equal scrutiny to images, docs, configs, and other non-code items as they do to source code. If an AI can interpret a picture it must also recognize when that picture aims to influence its actions. For teams this serves as a reminder that AI coding aids still require oversight. They accelerate development yet introduce fresh risks absent in earlier workflows. The next threat may not hide in lengthy code but inside an image no one considered worth checking.