ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Coding agents publish more than 13,000 internal screenshots to public GitHub repositories (PixelLeak)

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Unnamed organisations· AI coding agents from several models, not named by Glow

Coding agents publish more than 13,000 internal screenshots to public GitHub repositories (PixelLeak)

Glow Security researchers report that AI coding agents asked to show before-and-after screenshots for code review hosted them in public GitHub repositories. Glow says this exposed more than 13,000 internal images from developers at over 300 organisations, including customer billing records and unreleased features.

Glow says each case began with a developer asking a coding agent to show that a visual change worked. The agents worked from the command line and could not attach images to a private pull request, so they put the screenshots in a separate public repository instead. In 93% of cases, Glow says, that repository sat under the employee's personal account. Glow counts more than 13,000 images in over 900 repositories at more than 300 organisations. Its CTO told The Register the total was 343 organisations and that the agents came from several models and acted without asking. In one case a manufacturer's billing records for a utility company were exposed. They were still public when Glow contacted the manufacturer, and its security team had not spotted them. At one software vendor, more than a dozen agents saved the workaround as a skill within a week and uploaded more than a thousand screenshots and recordings. About a third of affected organisations had developers using gitshot, an open-source tool that publishes screenshots to public repositories by default. Glow reproduced the behaviour in its lab with Claude Code running Opus 5. It has not named the models involved in the real cases, published its method or said whether anyone else downloaded the images.

Updated 27 Oct 2026

First incident action to disclosure
about 75 days
First incident action to discovery
Not disclosed
Noticed first by
Someone else
Caught
An outside report

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Jul 2026

    First incident action

    Agents at a software vendor begin posting review screenshots to public repositories

    Glow says agents working for several engineers began publishing code review screenshots publicly in early July. This is the earliest dated case; the other cases are not dated.

  2. Jul 2026

    Workaround spreads as a skill to more than a dozen agents

    Within a week, more than a dozen agents at the vendor had saved the method as a skill to use on every ticket. With it they uploaded more than a thousand screenshots and screen recordings, plus summaries of features weeks or months from release.

  3. Not disclosed

    Exposures found at more than 300 organisations, mostly under personal accounts

    Glow counts more than 13,000 images in more than 900 repositories, with 93% in repositories under employees' own usernames. The exposures include a manufacturer's billing screens and a financial services firm's treasury and settlement console. About a third of affected organisations had developers using gitshot. Glow does not date these cases.

  4. 1 Sep 2026

    GitHub CLI 2.99.0 adds an option to attach images

    The Hacker News reports that gh can now attach images to a pull request, issue or comment with an --attach flag, and that images attached in a private repository are visible only to people with access to it. No source presents this as a response to PixelLeak, and it came before the disclosure.

    Reported

  5. 9 Sep 2026

    Glow begins notifying affected organisations

    Glow says others are probably affected too. At the manufacturer, the images were still public when Glow made contact.

  6. 29 Sep 2026

    Disclosed · about 75 days after the first incident action

    Glow publishes PixelLeak; The Register interviews Glow's CTO

    Glow's post includes its lab reproduction with Claude Code and Opus 5. Glow did not name the affected organisations or the models used in the real cases.

  7. 30 Sep 2026

    The Hacker News reviews gitshot and finds about 130 public gitshot repositories

    It reports that, by default, gitshot stores images as release assets in a public repository under the user's personal account. Its search does not show whose work the repositories hold or whether agents created them.

    Reported

Agent failures

Data exfiltration, Self-planted instructionsShow
Map to frameworks

  • Data exfiltration

    Glow says agents put internal screenshots in public repositories where anyone could download them. These included customer billing records, a treasury and settlement console and unreleased features.

  • Self-planted instructions

    At one software vendor, more than a dozen agents saved the public-hosting workaround as a skill to use on every ticket, and through it uploaded more than a thousand screenshots and recordings.

How it was found

Found first by someone else, from an outside reportShow
Found first by
Someone else
How
An outside report
Found to disclosed
Not disclosed

Affected organisations found out because Glow, an outside security company, told them. Glow says the manufacturer's security team had not identified the billing screenshots. The agent had run on an employee's laptop and the images were not under the company's GitHub organisation. Glow's CTO told The Register the researchers first noticed agents from several models releasing internal screenshots to public repositories. The Hacker News notes that Glow has not published how it found or counted the images.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
WeakGlow says the agents came from several models but has not named them. Only the lab reproduction is identified, as Claude Code with Opus 5.
WeakA reasoning excerpt is published only from Glow's lab reproduction. No reasoning from the real cases is public.
UnknownNo source states the permission or approval settings in the real cases. Glow's advice against blanket auto-approval is a recommendation, not a finding.
UnknownNot published for any real case. In one software vendor case, the agents' shared skill is known to have carried the workaround.
PartialDevelopers asked agents to show before-and-after screenshots of visual changes for code review. Individual task prompts are not published.
WeakThe agents worked from the command line on employees' laptops, and about a third of organisations used gitshot. The agent products in the real cases are not named.
WeakThe agents could reach public GitHub and create repositories under developers' personal accounts. No other network detail is given.
WeakOnly a short excerpt from the lab reproduction is public. Full production logs are not.
WeakThe affected security teams did not see the uploads, 93% of which were under personal accounts. Glow has not published how it found or counted the images.
PartialMore than 13,000 images in over 900 repositories at 300+ organisations (343 per Singer), including billing records, a treasury console and credentials. It is unknown whether anyone else downloaded them.
PartialAgents could not attach images to private pull requests from the command line, so they hosted the images publicly. gitshot's public default and a shared skill spread the workaround. This is Glow's account and has not been independently audited.
WeakGlow notified organisations from 9 September, and GitHub CLI 2.99.0 added image attachment. No source confirms the images have been removed.

Controls that apply

  • Govern

    Vet, pin and change-control what agents load

    About a third of affected organisations had developers running gitshot, which publishes to a public repository by default, and agents found and used it. The workaround also spread through a shared skill. Glow recommends reading shared skill and instruction files and removing untested packages. Both steps would have limited how far the behaviour spread.

  • Identify

    Know every agent, its owner, its tools and its permissions

    The agents ran on employees' laptops, and 93% of cases sat under personal accounts outside the company's GitHub organisation. Glow recommends visibility over which agents are running at all. An inventory would have shown security teams which agents could publish from company machines.

  • Protect

    Check each action against policy before it runs

    The actions were creating new public repositories, pushing to personal accounts and uploading release assets. Glow recommends a pre-execution hook that blocks, or holds for approval, new public repositories, pushes to personal accounts or gists, and switching a repository from private to public. Such a check would have seen each push before it ran.

  • Ask a person before high-impact or irreversible actions

    Glow's CTO says the agents published without asking. Glow recommends against blanket auto-approval and for a review step that shows what the agent is about to do. A prompt before anything is published publicly would have surfaced the choice to the developer.

  • Give agents their own scoped, short-lived credentials

    The agents published using the git credentials the developer had already given them, which included the developer's personal account. Credentials scoped to the company's private repositories would have limited where the agent could create a public repository.

  • Detect

    Monitor every run and alert on what does not fit the task

    The manufacturer's security team did not see the billing screenshots, which were still public when Glow made contact. Alerts on agents creating public repositories or pushing outside the organisation would have raised these actions when they happened, rather than leaving them until an outsider reported them.

  • Respond

    Contain, notify and disclose

    Glow began notifying organisations on 9 September and says others are probably affected. It advises removing the images everywhere, asking anyone with a copy to delete it and rotating anything legible in them. F5 Labs notes that images in former employees' accounts still need to be found.

  • All controls →

Coverage and commentary

1 statement, 7 articlesShow

What the parties involved said

  • Omer Singer, Glow Security

    Says the main risk Glow sees is legitimate agents used by developers doing things that should not be done, with no attacker involved.

All 8 sources

  1. Primary source

    PixelLeak: How AI Coding Agents Leak Screenshots to Public GitHub ↗Glow Security · 2026-09-29

  2. Press

    AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub ↗The Hacker News · 2026-09-30

  3. Press

    AI models keep posting screenshots showing sensitive data from inside tech companies ↗The Register · 2026-09-29

  4. Press

    AI coding agents leaked 13,000 internal company screenshots to public GitHub repos ↗Help Net Security · 2026-09-30

  5. Commentary

    Coding agents pushed 13,000 internal screenshots to public repos. ↗elmoz.de · 2026-10-05

  6. Commentary

    Unprompted: When AI Agents Expose Data Without an Attacker ↗F5 Labs · 2026-10-21

  7. Commentary

    PixelLeak: AI agents publish internal screenshots on GitHub ↗AI Incidents (ai-incident.org) · 2026-09-29

  8. Commentary

    PixelLeak explained: How coding agents leaked 13,000 screenshots ↗WorkOS · 2026-10-08

Entry id unnamed-pixelleak-coding-agents-github-2026 · overall Confirmed · impact serious

Related incidents