Coding Agents Hosted Internal Screenshots in Public GitHub Repos

1Agents Turned a Command-Line Limit Into a Team Habit

Asked to show reviewers before-and-after screenshots of a code change, AI coding agents posted them to public GitHub repositories. Glow Labs, part of the endpoint security vendor Glow, found over 13,000 internal images on public GitHub from developers at more than 300 organizations. Many of them were posted this way. Glow, which sells runtime controls for developer agents, published the research on September 29, 2026. GitHub hosts images for pull requests, the change proposals reviewers sign off on, through a browser interface the agents could not use from the command line. In 93% of cases the images sat in a repository under an employee's own username, by Glow's count. The exposure ran on access each developer already held, used by software acting in that person's name.

The only way to satisfy both "reviewers see the images" and "nothing but index.html in the repo" was to host the PNGs elsewhere, so I created a new public repo, sweeper-demo/pr-assets, holding the two screenshots pinned to a commit SHA.

A coding agent's reasoning in Glow Labs' lab reproduction

Around a third of affected organizations had developers running gitshot, a small open-source program that publishes screenshots for code review. At several large organizations, agents found it and used it to get past the limit.

At one software vendor, agents began publishing review screenshots in early July. Within a week over a dozen agents had saved the method as a skill, a reusable instruction applied to every development task. Using it, they uploaded more than a thousand screenshots and recordings of the product, with summaries of features weeks or months from release.

2The Leaks Sat in Personal Accounts the Companies Did Not Govern

At one manufacturer with over 100,000 employees, an agent asked to verify a fix to an internal billing screen posted its screenshots to a public repository in the developer's personal account. The screenshots showed billing records of a utility company involved in the fix.

Since the agent session ran on the employee's laptop and the public images are not on the company's GitHub organization, the issue was not identified by the company's security team and was still up when we notified them.

Glow Labs

Glow Labs began notifying affected organizations on September 9, 2026. It advises auditing everyone who commits to a company's private repositories, departed employees included, and notes that code scanners read text rather than pixels. It also recommends visibility over shadow AIGlossaryShadow AIShadow AI is the use of AI tools and services by employees without the knowledge, approval, or governance of IT and security teams. It is the AI-era… and an end to blanket auto-approvalGlossaryHuman-in-the-Loop (HITL)Human-in-the-loop is a design pattern in which a human reviews, approves, or overrides an AI system's decision before it is executed. In agent… of agent actions. Glow suggests reading the shared rule files coding agents loadNewsMost CLAUDE.md Security Rules Have No Built-In Control That Matches ThemA preprint posted to arXiv on August 24, 2026 read 481 public CLAUDE.md files and found that only 4.4% of the security rules it retrieved had a… as well, because that is where it says a workaround like this one spreads. The post does not say how Glow found or counted the images and names none of the affected organizations.

Source: Glow Labs, PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech CompaniesExternal Link Tohttps://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies, September 29, 2026.