Bipolar Image is a free web tool that builds a single picture file that shows you a fire and shows an AI chatbot three ice cubes. It turned up on Hacker News on 19 October 2026. It’s a neat and slightly unsettling reminder that what a model “sees” may not be what you see.
Key takeaways
- Bipolar Image lets anyone pair an image for humans with a different image for AI, all inside one file.
- The site, whose creator isn’t named, shows Claude, ChatGPT, Gemini and Grok all describing ice cubes on 19 October 2026.
- Its results page claims 42 out of 42 API tests passed across OpenAI, Anthropic and Google models.
- The site doesn’t explain its method, but researchers have published two tricks that produce this effect: image-scaling attacks and alpha-channel hiding.
- The real risk isn’t pranks. It’s hidden instructions inside images that get fed to AI agents.
What is Bipolar Image and what does it do?
The demo is simple. You see a photo of flames. Download the file, attach it to an AI chat and ask what’s in it. The model describes ice cubes.
A “Create” tab lets you choose your own pair: one image for people and one for the model. It accepts PNG, JPEG, WebP and similar formats up to 20 MiB. The site also gives one warning: use the file itself, because “screenshots and copied images can change the result.” That line is a clue, and we’ll come back to it.
The proof page lists 42 API responses dated 19 October 2026, and every one is marked “Pass.” The model sweep covers eight OpenAI models, seven Anthropic models and eight Gemini models, followed by extra validation runs and five reasoning-effort levels. The page says each submitted image matched the download byte-for-byte. We couldn’t rerun these tests ourselves, so treat them as the creator’s claims.
How can one image file show two different pictures?
Bipolar Image doesn’t say. Two published techniques do exactly this, though, and the screenshot warning fits both of them.
Trick one: the scaling attack. Vision models usually don’t see your full-resolution photo. Many AI pipelines shrink large images first, using resampling methods such as nearest neighbour, bilinear or bicubic, which merge blocks of pixels into one. If you craft those pixels carefully, the small version shows something the big version hides.
Think of a street painting that only looks 3D from one spot on the pavement. Trail of Bits named its open-source tool, Anamorpher, after that art form (anamorphosis). In an 21 August 2025 post, its researchers Kikimora Morozova and Suha Sabi Hussain showed hidden text appearing after downscaling in Gemini CLI, Vertex AI Studio, Gemini’s web app and API, Google Assistant on Android and Genspark. Their work builds on research by Quiring and colleagues, presented at USENIX Security 2020.
Trick two: the alpha channel. PNG files can carry a transparency layer, called the alpha channel. Your browser blends see-through pixels with the page behind them. A model’s pipeline may flatten them differently or read the raw colour values. In February 2024, David Noever and Forrest McKee of PeopleTec described hiding a second image in that layer. They tested vision systems from Apple, Microsoft, Google, Salesforce, Nvidia and Facebook.
| Technique | Where the second image hides | What breaks it | Documented by |
|---|---|---|---|
| Image-scaling attack | In pixel patterns that only appear after the image is shrunk | Changing the size or the resampling method | Trail of Bits, 2025; Quiring et al., 2020 |
| Alpha-channel hiding | In the PNG transparency layer | Flattening onto a fixed background | Noever and McKee, 2024 |
Our opinion: a screenshot re-renders the picture at screen size and flattens any transparency, so it would break either trick. That fits the site’s warning neatly. Until the creator explains, though, this is an educated guess.
Why does the Bipolar Image trick matter for AI security?
Swapping fire for ice is a party trick. Swapping it for text gives you a prompt injection: hidden instructions that the model treats as if you’d typed them.
Trail of Bits showed how bad that can get. In one demo, Gemini CLI was connected to a Zapier MCP server set to approve tool calls automatically. A user uploaded an image that looked harmless, and the hidden prompt made the agent email the user’s Google Calendar data to an attacker. Nobody was asked to confirm anything.
Attacks are also getting smarter. A December 2025 arXiv paper, Chameleon, by M Zeeshan and Saud Satti, uses an AI agent to tune the hidden pattern based on the target model’s replies. Against Gemini 2.5 Flash, it reported an 84.5% attack success rate across different scaling factors. Fixed, non-adaptive attacks averaged 32.1%.
If your company is connecting AI assistants to inboxes, calendars and files, as many firms now are (see how AI is changing small businesses), this is part of your attack surface. Any image an agent reads is input you can’t fully see.
How can you protect yourself and your tools?
- Show the model’s view. Trail of Bits recommends always previewing exactly what the model receives, even in CLI and API tools.
- Limit upload size instead of downscaling. If images never get shrunk, the scaling trick has nothing to exploit.
- Confirm sensitive actions. Text inside an image should never be able to send email, move money or share files on its own.
- Flatten transparency. Turning PNGs into flat images before analysis removes the alpha hiding place.
- Check at several sizes. The Chameleon authors suggest comparing what a model sees at multiple scales.
- For everyday users: be careful with images from strangers when your assistant can reach your email, files or accounts.
What happens next
Bipolar Image turns research that used to need code into a point-and-click toy. That makes it easier for curious users and bad actors alike. The obvious questions for OpenAI, Anthropic, Google and xAI are whether they will preview downscaled input and handle transparency the same way your screen does. When this was written on 20 October 2026, we had found no public response from any of them to the tool.
Watch for the creator to explain the method, for independent testers to check the 42-test claim, and for agent platforms to add confirmation steps by default. Adaptive attacks like Chameleon suggest this cat-and-mouse game is only starting.
FAQ
Is Bipolar Image safe to try?
The demo pairs harmless pictures of fire and ice. As with any upload site, don’t send it private photos, and only test with images you’re happy to share.
Why does a screenshot break the effect?
The site itself warns that screenshots and copies can change the result. A screenshot re-renders the image at screen size and flattens transparency, which would wipe out the carefully tuned pixels or the hidden layer.
Which AI models does it fool?
The creator’s screenshots from 19 October 2026 show Claude Sonnet 5.5, ChatGPT on GPT-6, Gemini Flash and Grok all describing ice cubes. The proof page lists 42 passing API tests across OpenAI, Anthropic and Google models. Nobody has independently verified these results.
Try the demo on a harmless image, then ask yourself one question about every AI tool you use: can it show you what it actually sees?
Leave a comment