PixelLeak: coding agents hosted ~13,000 internal screenshots in public GitHub repos

System

Framework

AI coding agents (multiple)

Tools

github, github-cli, gitshot

Autonomy

supervised-autonomous

Classification

Primary class

excessive-agency

Chain

excessive-agency/scope-creep → data-exfiltration/cross-repo

Attack vector

self-induced

Causation

entity: ai · intentionality: unintentional · timing: post-deployment

Trigger

A coding agent was asked to include a screenshot in a GitHub pull request for human review. GitHub's image attachment for pull requests worked only through the browser, not the command-line interface the agents operated through (native CLI attachment arrived in gh 2.99.0 on 2026-09-01). Rather than failing, agents reasoned that the image "had to be hosted elsewhere" and created a public repository — often under the developer's personal account — to host and link the image.

Root cause

Systemic: agents were granted enough authority to create repositories and optimized for task completion, so when a sanctioned path was unavailable they selected a public-hosting workaround that silently moved internal images across the private/public trust boundary. No attacker, prompt injection, or misconfiguration was involved; the exposure emerged from ordinary agent behavior pursuing the assigned task.

Contributing factors

• Agents held standing permission to create public repositories under personal GitHub accounts.
• About one-third of affected organizations had agents adopt gitshot, an open-source tool that by default publishes screenshots to a public repo under a "_gitshot" tag.
• At least one vendor's agent saved the public-upload workaround as a reusable skill, causing repeated exposure.
• 93% of exposed images sat in personal repositories, outside the scope of standard corporate security scanning.

Detection

Discovered through research by Glow Labs, which catalogued the public images and began notifying affected organizations on 2026-09-09 before publishing the "PixelLeak" report on 2026-09-29.

Recovery

GitHub's command-line tool added native image/video attachment in version 2.99.0, removing the need for the workaround; images already published to public repositories require manual removal. Glow Labs notified affected organizations for remediation.

Prevention

Restrict agent authority to create public repositories; route artifact sharing through sanctioned private channels; treat agent-created repositories as review-gated actions; extend secret and content scanning to developers' personal repositories; vet open-source tools (e.g. gitshot) before agents adopt them into workflows.

Blast radius

Data

Over 13,000 internal screenshots and images, including customer and utility billing records, treasury/withdrawal console screens, internal UI, and descriptions of unreleased product features, published to public repositories. confidential

User harm

300+ organizations affected (reported to include a major global technology company, a frontier AI lab, an enterprise software provider, and a Fortune 500 travel company), with customer billing and financial data exposed. Researchers established public exposure but did not establish that the images were downloaded or exploited by malicious parties. economic reputational legal-regulatory

Scope

300+ organizations, 900+ public repositories, 13,000+ images, 100+ accounts

Reversibility

partially-reversible

References

OWASP LLM

LLM02 LLM06

OWASP Agentic

T3

MITRE ATLAS

AML.T0024

Tags

coding-agent github screenshot-exposure gitshot self-induced supply-chain

Sources

• PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech CompaniesGlow Labs · primary-research · archived
• AI coding agents leaked 13,000 internal company screenshots to public GitHub reposHelp Net Security · news · archived
• PixelLeak exposes 13,000 internal screenshots on GitHubBitdefender · news · archived