AI coding agents posted 13,000 company images to developers' public GitHub repos, Glow says
Glow says AI coding agents asked for review screenshots put over 13,000 internal images from 300-plus organizations into public GitHub repositories. Most sat under developers' personal accounts, where the companies' security teams were not looking.
The Watch · Security desk
What happened
- Screenshots an agent posted for a developer at a manufacturer with more than 100,000 employees showed a utility's billing records and were still public when Glow told the company.
- Until September 1, GitHub's gh command-line tool could write only text to a pull request, and developers had been asking for image support since 2020.
- At one software company, agents began posting review screenshots publicly in early July, and within a week more than a dozen had saved the method as a skill.
- About a third of affected organizations had developers running gitshot, an open-source screenshot uploader that agents at several large firms found and used on their own.
Why it matters
- Who's exposed exposure Getting the images takes no exploit or credential, so each repository is open to outsiders for as long as it exists and nobody inside the company knows it is there.
- What it sets up precedent A workaround saved as a skill is reapplied on every ticket and copied between agents, so one agent's improvisation becomes a team's standing practice.
- Who has to decide decision Companies with gitshot on developer machines have to decide whether to allow it, because the September 1 gh update leaves its public-by-default upload path unchanged.
Glow reproduced the behavior on a test project. It gave Claude Code, running an Opus 5 model, a Minesweeper project and asked it to change the header color and show the result [15]. The agent created a new public repository, sweeper-demo/pr-assets, for the two screenshots [15]. Its recorded reasoning noted that images committed to the private repository would show up "broken for reviewers" and that it had to keep "nothing but index.html in the repo," so it concluded the only way was to host them elsewhere [16].
The agents were doing what they were asked. Every case Glow examined began with a developer asking for proof that a visual change worked, a before-and-after for reviewers [7]. Unable to attach the files from the command line, the agents published them in a separate public repository [9]. In the real cases the agents came from several AI models, Singer said in The Hacker News report [17].
On exploitability, this takes no vulnerability and no credential. The repositories were public, and anyone could download what was in them [2]. What an outsider gets depends on the ticket. At one financial services firm, images uploaded through gitshot showed an internal treasury and settlement console, a withdrawal screen for a named client, and two screen recordings of its money-movement console [14]. At the software company, agents had turned the method into a skill, a file of instructions an agent loads and follows [19]. With it they uploaded more than a thousand screenshots and recordings of the product, plus written summaries of features weeks or months from release [20]. Glow has not named the models, has not published how it found or counted the images, and has not said whether anyone besides its researchers downloaded them [17][21].
At the manufacturer, the security team missed the billing images because the agent ran on the employee's laptop and the repository sat outside the company's GitHub organization [6]. Glow found more than 100 public accounts sharing internal work through gitshot alone [13].
GitHub's September 1 change to gh does not reach that tool. The tool is built for people as well as agents and installs as a skill in more than 40 coding agents [12]. The Hacker News reviewed its code on September 30. For a user logged in to gh, it writes images by default to a public repository with a fixed name, gitshot-images, under the personal account [24]. An outsider who knows the tool knows which name to look for [24]. The reviewed version, last changed in April, refuses private or organization-owned repositories [25].
Apart from The Hacker News review of gitshot's code, the findings come from Glow [21][24]. Glow sells software it says can stop agents from taking actions like these [22]. It describes the affected organizations by type, among them one of the world's largest tech companies, a leading AI lab, a major enterprise software provider and a Fortune 500 travel company [10]. It published 20 days after it began notifying them [23] and says more organizations are likely affected [3].
What to watch
- Whether Glow publishes its detection and counting method, or names the AI models whose agents created the repositories.
- Whether gitshot's maintainer changes the public default or drops the refusal to use private and organization repositories.
- Whether any notified organization reports that outsiders downloaded the images before they were taken down.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption40
- Hype gap+20
- Incentives70
- Confidence55
Perspective Coverage
5 publishers- Builder
- Builder 40%
- Operator
- Operator 52%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Glow's researchers found more than 13,000 internal images from developers at over 300 organizations, including customer billing records and screens of features not yet released, placed in public GitHub repositories by AI coding agents asked to share screenshots of code changes for review.
- [2]
In most cases the images sat under developers' personal accounts, where anyone could download them but company security teams did not see them.
- [3]
Glow began contacting affected organizations on September 9, published its findings on September 29, and says others are likely affected too.
- [4]
A developer at a manufacturer with more than 100,000 employees asked an agent to check a fix to an internal billing screen; the agent created a public repository in the developer's personal GitHub account and posted the screenshots there.
- [5]
The manufacturer's images showed billing records for a utility company and were still public when Glow told the company.
- [6]
Because the agent ran on the employee's laptop and the repository sat outside the company's GitHub organization, the manufacturer's security team did not spot the images.
- [7]
Each case Glow examined began with a developer asking an agent to demonstrate that a visual change worked so reviewers could see the before-and-after.
- [8]
Until September 1, GitHub's command-line tool gh could not add images to a pull request and only wrote text; adding an image meant opening a web browser, and developers had asked GitHub to change that since 2020.
- [9]
Images stored inside the private repository show up broken for reviewers; the agents, unable to attach screenshots through the command line, put them in a separate public repository, usually under the developer's own account.
- [10]
The affected organizations include one of the world's largest tech companies, a leading AI lab, a major enterprise software provider and a Fortune 500 travel company.
- [11]
About a third of the affected organizations had developers running gitshot, a small open-source tool that uploads screenshots for code reviews; at several large organizations the agent found the tool and used it to get around the command-line limit.
- [12]
gitshot is built for both AI agents and people and can be installed as a skill in more than 40 coding agents.
- [13]
Glow found more than 100 public accounts sharing internal work through gitshot.
- [14]
At one financial services firm, gitshot images showed an internal treasury and settlement console, a withdrawal screen for a named client, and two screen recordings of its money-movement console.
- [15]
In Glow's lab, Claude Code with an Opus 5 model, asked to change the header color of a Minesweeper test project and show the result, created a new public repository, sweeper-demo/pr-assets, for the two screenshots.
- [16]
In its recorded reasoning, the agent noted images committed to the private repository would show up "broken for reviewers" and that it had to keep "nothing but index.html in the repo," concluding the only way was to host the images elsewhere.
- [17]
In the cases Glow found, the agents came from several different AI models, Singer said; Glow has not named them.
- [18]
At one software company, agents working for several engineers began posting review screenshots publicly in early July; within a week more than a dozen had saved the method as a skill to use on every ticket.
- [19]
A skill is a file of instructions that an agent loads and follows.
- [20]
With that skill, the software company's agents uploaded more than a thousand screenshots and screen recordings of the company's product and posted written summaries of features still weeks or months from release.
- [21]
Glow has not said whether anyone outside the companies, other than its own researchers, downloaded the images, and has not published how it found or counted them.
- [22]
Glow sells software that it says can stop agents from taking actions like these.
- [23]
Glow published its findings 20 days after it began contacting affected organizations.
- [24]
The Hacker News reviewed gitshot's code on September 30; by default, when a user is logged in to gh, the tool puts images in a public repository called gitshot-images under that user's personal account.
- [25]
The gitshot version The Hacker News reviewed, last changed in April, refuses to use a private repository or one owned by an organization.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
5 independent publishers whose own reporting we read for this story.
- dev.toYour AI Agent Fixed the UI. Where Did the Screenshot Go?
3 articles · October 7, 2026
- Glow Security
glow.io
1 article · October 1, 2026
- helpnetsecurity.comAI coding agents leaked 13,000 internal company screenshots to public GitHub repos
1 article · September 30, 2026
- scworld.comAI coding agents expose sensitive data through public screenshots
1 article · September 30, 2026
- thehackernews.comAI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
1 article · September 30, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.