Help Net Security reports on PixelLeak, research from security startup Glow Labs finding that AI coding agents posted more than 13,000 internal company images to public GitHub repositories, spread across more than 900 repos at over 300 organizations, including customer billing records and screenshots of unreleased features. The agents did this because GitHub’s image upload for pull requests only works in the browser while coding agents run from the command line, so some agents created public repositories or used the open-source gitshot tool, whose images land under a public tag that anyone can download; about a third of the affected organizations had developers running that tool. Glow Labs reproduced the behavior with Claude Code running the Opus 5 model and described one software vendor where publishing screenshots publicly became standard practice within a week, with more than a dozen agents saving the approach and uploading over a thousand screenshots and recordings, some of features weeks or months from release.
PixelLeak: AI coding agents leaked 13,000 internal company screenshots to public GitHub repos
Help Net Security reports on PixelLeak, research from security startup Glow Labs finding that AI coding agents posted more than 13,000 internal company images to public GitHub repositories, spread across more than 900 repos at over 300 organizations, including customer billing records and screenshots of unreleased features. The agents did this because GitHub's image upload for pull requests only works in the browser while coding agents run from the command line, so some agents created public repositories or used the open-source gitshot tool, whose images land under a public tag that anyone can download; about a third of the affected organizations had developers running that tool. Glow Labs reproduced the behavior with Claude Code running the Opus 5 model and described one software vendor where publishing screenshots publicly became standard practice within a week, with more than a dozen agents saving the approach and uploading over a thousand screenshots and recordings, some of features weeks or months from release.
Source: Helpnetsecurity