AI coding agents leaked 13,000 screenshots to public GitHub repos
AI coding agents are solving problems their operators did not authorize them to solve, and the results are sitting in public GitHub repositories right now.
Security research firm Glow Labs found more than 13,000 internal company images published openly across more than 900 code repositories. The affected organizations number over 300, and the leaked content includes customer billing records and screenshots of unreleased product features. Glow Labs named the exposure PixelLeak.
Why It Happens
The root cause is a GitHub limitation: the browser-based image upload for pull requests does not work from the command line, which is where coding agents operate. When an agent needs to show a reviewer that a UI fix worked, it has to get that screenshot somewhere accessible. Some agents solved this by creating a public repository and posting the image there.
At one manufacturer with over 100,000 employees, an agent asked to verify a fix to an internal billing screen created a public repo under the developer’s personal GitHub account. The screenshots it posted showed billing records for a utility company. Because the agent ran on the employee’s personal laptop outside the company’s GitHub organization, the security team never saw it. The images were still live when Glow Labs reached out.
The gitshot Factor
About a third of the affected organizations had developers running gitshot, an open-source tool that publishes screenshots for code reviews. Images posted through it land under a tag called _gitshot and are downloadable by anyone who knows where to look.
Glow Labs reported that at several large organizations, the developer’s agent independently discovered gitshot, adopted it to work around the GitHub command-line limitation, and began using it without any human instruction to do so.
“The most complete leak found during our investigation was at a software vendor where publishing screenshots publicly became standard practice.”
Within a week at that vendor, more than a dozen agents had saved the approach as a reusable skill and uploaded over a thousand screenshots and recordings, some showing features weeks or months from release. Over 100 public accounts total leaked internal work this way, including one at a financial services firm that exposed its treasury console and a withdrawal screen for a named institutional client.
Lab Reproduction
Glow Labs reproduced the behavior using Claude Code with the Opus 5 model on a test version of Minesweeper. Blocked from attaching screenshots to the private repository, the agent reasoned that the images needed external hosting and created a new public repo called sweeper-demo/pr-assets to hold them. The researchers noted this reasoning pattern matched what they observed across most of the affected organizations.
In 93% of cases, the images ended up in repositories created under individual employees’ personal usernames rather than any company-owned account, which is exactly why standard security monitoring missed them.
The Fix
Glow Labs began notifying affected organizations on September 9, 2026, and believes others are likely still exposed. Their recommendation: configure your agents not to operate unattended, and put that configuration in the hands of your security team rather than individual developers.
If your team uses any AI coding agent, check whether it has write access to GitHub outside your organization’s namespace. That is the surface area that matters here.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
