PixelLeak investigation reports over 13,000 internal screenshots stored publicly by coding agents
Security company Glow Labs reports that coding-agent screenshot workflows exposed internal images from more than 300 organizations in public GitHub repositories. A private code project does not guarantee private attachments.
In the PixelLeak investigation archived on October 1, Glow Labs reported more than 13,000 internal images publicly stored on GitHub by developers at over 300 organizations, across more than 900 repositories. It said the material included customer records, unreleased features and some sensitive information. These are the company's findings. AiEvent has not independently reproduced all cases or read and displayed exposed screenshots and credentials.
The report describes a specific mechanism: a developer asks a coding agent to change an interface and attach before-and-after screenshots for review. Working through a command line, the agent cannot use GitHub's web attachment flow, so it stores images in another publicly accessible repository. Glow says 93% of cases were in repositories created under employees' personal accounts, with some using gitshot. This observation cannot be generalized to every agent.
Once screenshots are stored publicly elsewhere, the original project’s private permissions no longer protect them. Glow recommends checking personal repositories, release attachments and gists, along with agents’ permission to create public repositories. Glow sells security products, so the findings should be read as a commercial company’s investigation. This is separate from OpenAI’s 53 reported research-user image transmissions.
Sources
- Security startup finds more than 13,000 internal company screenshots that AI agents uploaded publicly — The Decoder
- Glow: The Endpoint AI Company | PixelLeak AI exposure of private developer data — Glow Security