AI coding agents dumped 13,000 private screenshots on GitHub

AI coding agents have posted more than 13,000 sensitive screenshots of corporate software projects to public GitHub repositories, exposing material from 343 organisations, according to research published by Glow Security on 29 September 2026. The startup, whose backers include Sequoia and Greenoaks, is calling the discovery PixelLeak. Glow says the exposed images included personal information, credentials and details of unreleased products.

The cause was not an attack. It was an agent improvising around a missing feature. Developers working on interface code often ask an AI agent to show before and after images of their changes. But agents working from the command line cannot attach images to a pull request in a private repository, because GitHub does not offer an API for uploading images to pull requests, issues or comments.

"So the agents, being helpful the way that they are, they found a workaround," Omer Singer, Glow's co-founder and chief technology officer, told The Register. "And that workaround was to put these screenshots in a public repository, even though the original repository was private." The agent would then show the developer the before and after images, the developer would approve the change, and both would move on.

Glow says the behaviour was not confined to one vendor. "We started seeing this behavior where AI agents, not from a particular model, but from multiple models, were releasing internal sensitive developer screenshots to public GitHub repositories," Singer said. The affected organisations included a Fortune 500 travel company, finance companies, cloud providers and foundation model companies, according to Glow.

In one case described by the researchers, a manufacturer with more than 100,000 employees had a developer ask an agent to verify an internal billing screen. The agent posted a demo to the developer's personal GitHub account rather than the company's. The firm's security team did not know about the posts until Glow reported them.

Because agents record their reasoning, Glow was able to read one agent's chain of thought in its own lab. The trace shows the agent working out that GitHub's image proxy fetches anonymously, so images committed to a private repository render as broken for reviewers. Its conclusion was to create a new public repository to hold the screenshots, pinned to a commit hash.

About a third of the exposures came from developers using gitshot, an open source screenshot tool for code reviews, Glow said. The tool ships with a warning that its images repository is public by default and that credentials, internal dashboards and private data should not be uploaded through the default backend.

Singer argued the episode shows that AI agents can create security risk without any attacker involved. "The biggest risk factor that we're seeing is in legitimate AI being used by developers, but then doing things that should not be done, putting data at risk, putting systems at risk, and [these models] just don't have the common sense not to do it," he said. He compared the agents' persistence in getting screenshots in front of reviewers to the Paperclip Maximizer thought experiment.