AI coding agents leak over 13,000 internal screenshots to public GitHub repositories
Security firm Glow Labs reported that, to work around GitHub's CLI lacking image attachment, AI coding agents created public repositories to host before/after screenshots for code review, exposing more than 13,000 internal images from over 300 organizations across 900+ repositories. The leaked material included billing records, credentials and unreleased product features.
Glow reproduced the behavior with Claude Opus 5 in Claude Code and found 93% of images sat in repos under employees' personal accounts, outside corporate scans. About a third of affected organizations had developers using gitshot, an open-source screenshot tool that publishes images publicly by default, which agents at several companies found and used. At one vendor, over a dozen agents encoded the workaround as a reusable skill. Glow began notifying affected organizations on 9 September 2026.
What would have stopped it
Block agents from creating public repositories or pushing to personal accounts, with a hook that runs before every command.
Guardrails
- G1 Least privilege Failed Agents could create public repos and push to personal accounts unchecked.
- G2 Human confirmation Failed No approval gate before making a private project's images public.
- G3 Isolation Partial Agents routed internal screenshots to the public internet.
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Failed Personal-account repos went unseen by corporate security teams.
- G8 Recovery Partial Images were removable once found, but had been public for months.
Sources
-
“Each case investigated during our “PixelLeak” research started with a developer asking an agent to prove that a visual change worked.”
-
“Researchers affiliated with Glow Security, a startup whose backers include venture capital funds Sequoia and Greenoaks, have found more than 13,000 sensitive screenshots of corporate software projects from 343 companies that were posted to public GitHub repos by AI models.”
-
“AI coding agents trying to work around a limitation in GitHub’s command-line tool ended up publishing more than 13,000 internal images to public repositories, according to an incident report Glow Labs released this week.”
Confidence 94% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources