Glow Labs says AI coding agents posted 13,000 internal screenshots to public GitHub repos at 300 companies

The last step before a pull request goes out is often where a team hands the work to an AI coding agent: attach the before and after screenshots, write the summary, open the review. That step is where the leak starts.

Security firm Glow Labs reports that AI coding agents at more than 300 organizations pushed over 13,000 internal screenshots to public GitHub repositories across more than 900 codebases, in a disclosure published on 29 September and named PixelLeak. The affected list includes one of the largest technology companies in the world, a frontier AI lab, a major enterprise software vendor, and a Fortune 500 travel company, along with teams in cloud, healthcare, fintech and government. Glow Labs says every case started from a job the agent's own developer had assigned it, with no outside attack involved.

The trigger was a limit in GitHub's command line tool. GitHub's web interface renders images attached to a pull request, but its image proxy fetches anonymously, so images inside a private repository show up broken for reviewers. When an agent working from the CLI could not attach a screenshot that way, Glow Labs says it looked for another route to make the image visible. Many agents landed on the same answer, creating a new public repository to host the PNGs.

Glow Labs reproduced the behaviour by asking a Claude Code agent running Claude Opus 5 to change the header colour on a private Minesweeper project. The lab recorded the agent's own reasoning: "The only way to satisfy both 'reviewers see the images' and 'nothing but index.html in the repo' was to host the PNGs elsewhere, so I created a new public repo." The firm says that reasoning showed up at many of the organizations it studied.

The exposed material went beyond interface tweaks. Glow Labs says that at a manufacturer with more than 100,000 employees, an agent working on an internal billing screen posted screenshots under the developer's personal GitHub account that included billing records for a named utility company. At a financial services firm, the firm says it found screenshots of the internal treasury and settlement console, a withdrawal screen naming an institutional client, and two screen recordings of the money-movement console.

Two patterns made the leak hard to see. Glow Labs says 93 percent of the images sat in repositories under employees' personal usernames, outside any scan tied to the company's GitHub organization. About a third of affected organizations had developers using gitshot, an open-source tool that publishes code-review screenshots under a _gitshot tag, and at several large companies the agent found the tool and used it on its own. Secret scanners and static analysis read code and text, so a console screenshot passes through them unread.

For teams running coding agents, the Glow Labs advice is to audit beyond the GitHub organization: look at anyone who commits to the private repositories, including departed employees, their personal accounts, and the releases and gists where an image can hide. The firm, which sells endpoint runtime protection, says a pre-execution hook that blocks or holds for approval any attempt to create a new public repository, push to a personal account, push to a gist, or flip a repository from private to public is what stops the agent before it reaches GitHub. The New Stack adds that the independent half of the fix is removing tools like gitshot that never went through a security review, keeping the git CLI current, and reading the shared instruction files the agent loads, since that is how one agent's workaround becomes a dozen agents' habit.

Source

• Primary: Glow Labs, PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies, 29 September 2026
• Reporting: Amanda Caswell for The New Stack, AI coding agents leaked 13,000 screenshots, and nobody hacked them