# Coding Agents Hosted Internal Screenshots in Public GitHub Repos

_Over 13,000 internal images from developers at more than 300 organizations sat in public GitHub repositories, Glow Labs reported on September 29, 2026. Many were posted by AI coding agents that could not attach screenshots to private pull requests from the command line._

By Johannes Keienburg, CEO & Founder  
Published: 2026-10-06  
Source: https://www.cakewalk.security/blog/coding-agents-internal-screenshots-public-github

---

## Agents Turned a Command-Line Limit Into a Team Habit

Asked to show reviewers before-and-after screenshots of a code change, AI coding agents posted them to public GitHub repositories. Glow Labs, part of the endpoint security vendor Glow, found over 13,000 internal images on public GitHub from developers at more than 300 organizations. Many of them were posted this way. Glow, which sells runtime controls for developer agents, published the research on September 29, 2026. GitHub hosts images for pull requests, the change proposals reviewers sign off on, through a browser interface the agents could not use from the command line. In 93% of cases the images sat in a repository under an employee's own username, by Glow's count. The exposure ran on access each developer already held, used by software acting in that person's name.

> The only way to satisfy both "reviewers see the images" and "nothing but index.html in the repo" was to host the PNGs elsewhere, so I created a new public repo, sweeper-demo/pr-assets, holding the two screenshots pinned to a commit SHA.

_A coding agent's reasoning in Glow Labs' lab reproduction_

Around a third of affected organizations had developers running gitshot, a small open-source program that publishes screenshots for code review. At several large organizations, agents found it and used it to get past the limit.

At one software vendor, agents began publishing review screenshots in early July. Within a week over a dozen agents had saved the method as a skill, a reusable instruction applied to every development task. Using it, they uploaded more than a thousand screenshots and recordings of the product, with summaries of features weeks or months from release.

## The Leaks Sat in Personal Accounts the Companies Did Not Govern

At one manufacturer with over 100,000 employees, an agent asked to verify a fix to an internal billing screen posted its screenshots to a public repository in the developer's personal account. The screenshots showed billing records of a utility company involved in the fix.

> Since the agent session ran on the employee's laptop and the public images are not on the company's GitHub organization, the issue was not identified by the company's security team and was still up when we notified them.

_Glow Labs_

Glow Labs began notifying affected organizations on September 9, 2026. It advises auditing everyone who commits to a company's private repositories, departed employees included, and notes that code scanners read text rather than pixels. It also recommends visibility over [shadow AI](/glossary/shadow-ai) and an end to [blanket auto-approval](/glossary/human-in-the-loop) of agent actions. Glow suggests reading [the shared rule files coding agents load](/blog/claude-md-security-rules-without-controls) as well, because that is where it says a workaround like this one spreads. The post does not say how Glow found or counted the images and names none of the affected organizations.

> For a screenshot, the agent used the developer's right to create public repositories. An agent should act for a named person with only the access that person's task needs. Every call through a governed path gets a policy check and lands in one record of what was allowed, denied or escalated. This push went from a laptop into a personal account and touched no such path. Its only record is the public repository.

_Comment from Gil Röder, CPO & Co-Founder_

Source: Glow Labs, [PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies](https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies), September 29, 2026.