Security firm Glow says AI coding agents posted more than 13,000 internal screenshots from over 300 organisations to public GitHub repositories

Glow, a security company, said in a blog post on 29 September 2026, written by Glow Labs researchers Yoni Gottesman and Noam Kesten, that AI coding agents had put more than 13,000 internal images from developers at over 300 organisations into publicly accessible GitHub repositories, across more than 900 repositories.^[1][2][3] Glow, which calls the findings “PixelLeak”, says the material includes customer billing records and screenshots of features not yet released.^[1][2] It did not name the organisations, describing them as including “one of the world’s largest tech companies, a frontier AI lab, a major enterprise software provider, and a Fortune 500 travel company”.^[1] Cybernews reported the number of organisations as 343, a figure that does not appear in Glow’s post.^[1][4]

According to Glow, each case began with a developer asking an agent to show that a visual change worked, so that reviewers could see before-and-after images.^[1] Glow says GitHub’s image upload for pull requests is built for people using a web browser, while coding agents work through a text-based command line, and that the agents “figured out that they could make the image available to the human reviewer by hosting it in an adjacent public repo”.^[1] The company says the agents “just didn’t consider the security implications”.^[1] GitHub’s own changelog says that, before 1 September, its command-line tool gh “only wrote text”.^[6]

Glow gave three examples. At a manufacturer with more than 100,000 employees, it says, an agent asked to verify a fix to an internal billing screen created a public repository in the developer’s personal GitHub account and posted screenshots showing billing records for a utility company; Glow says the company’s security team had not spotted them and they were still online when it made contact.^[1][2] At a financial services firm, it says, images showed an internal treasury and settlement console, a withdrawal screen for a named institutional client and two screen recordings of a money-movement console.^[1] At a software vendor, Glow says, agents serving several engineers began posting review screenshots publicly in early July, and within a week more than a dozen had saved the approach as a skill, going on to upload more than a thousand screenshots and recordings, with descriptions of features weeks or months from release.^[1][2]

Glow says about a third of the affected organisations had developers running gitshot, an open-source tool that publishes screenshots for code review, and that at several large organisations an agent found the tool and used it to get around the command-line limit.^[1][2] Images it publishes end up under a tag called _gitshot and can be downloaded by anyone who knows where to look, Glow says.^[1] The tool’s own page says it creates a public gitshot-images repository by default and warns: “Do not upload sensitive content (credentials, internal dashboards, private data) using the default release backend.”^[7] Glow says 93% of the cases involved repositories that employees had created under their own usernames.^[1][2] The Hacker News reports that a search it ran on 30 September found about 130 public repositories created by gitshot, and says the search does not show whose work they hold or whether agents made them.^[3]

Glow says it reproduced the behaviour in its lab using Claude Code with an Opus 5 model on a test Minesweeper project: the agent created a public repository named sweeper-demo/pr-assets for two screenshots after reasoning that images in the private repository would show up broken for reviewers.^[1][2][3] The Hacker News reports that in the real cases the agents came from several AI models that Glow has not named.^[3] Glow began notifying affected organisations on 9 September and says others are likely affected.^[1][3] It recommends that security teams, not each developer, control how agents are configured, that organisations audit employees’ personal accounts, releases and gists, and that a review step come before an agent creates a public repository or pushes to a personal account.^[1][3] Its post says: “Hardening AI tool configurations is key for prevention.”^[1][2]

GitHub released version 2.99.0 of its command-line tool on 1 September 2026, adding an --attach flag that uploads images and videos to issues, pull requests and comments.^[5][6] GitHub’s changelog says coding agents can use it too, that it requires write access to the repository, and that GitHub Enterprise Server is not supported in that release.^[6] The Hacker News notes that Glow sells software that it says can stop agents taking such actions, and that Glow has not said whether anyone beyond its own researchers downloaded the images or published how it found and counted them.^[3]