Coding agents routed more than 13,000 private screenshots through public GitHub repos

Glow published one agent's reasoning, and it states the constraint plainly. The agent wrote that "GitHub cannot render images from a private repo in a PR description" ^[8]. Its explanation: "its image proxy fetches anonymously, so anything committed here (branch, release asset, whatever) shows up broken for reviewers" ^[9]. Then it described its fix. The agent wrote that hosting the PNGs elsewhere was the only way to meet both requirements, that reviewers see the images and that the repo hold nothing but index.html, so it created a new public repo, sweeper-demo/pr-assets, holding the two screenshots pinned to a commit SHA ^[10].

Against the requirements it was given, the solution is correct. Reviewers see the images. The private repo stays clean ^[10]. Confidentiality was not on the list, so the agent never weighed it. Tom's Hardware describes these agents as working with little human oversight ^[14]. The agent even pinned the files to a commit SHA, more version discipline than most humans give a screenshot ^[10].

The gap it worked around sits in the tooling. UI and UX changes routinely carry before-and-after screenshots, attached to the pull request for review ^[4]. A human gets a graphical upload for that. Agents work through the command line, which, according to Tom's Hardware, currently lacks the feature for private repositories ^[16].

About a third of affected companies used gitshot, a command-line tool for attaching screenshots, and its uploads carry a "_gitshot" tag that makes them easy to find ^[6]. On the report's floor of 300 organisations, the tag accounts for roughly 100 companies ^[15]. The other two-thirds got their images out some other way, and a tag search will not surface them.

Where the files landed is the harder problem. In 93% of cases the images sat in repositories under the developer's own username, not the company's GitHub account ^[7]. I think this is where org-level controls fall short. An audit scoped to the company organisation does not cover a personal namespace, and offboarding an employee does not take their personal repos with them. Glow's first recommendations aim here. Check that employees are not using repositories under their own accounts. Audit accounts and code held by people who have left. Curb "shadow AI" tools that staff sign up for without IT ^[12].

The skill case shows how one decision spreads. In one organisation the workaround was written into an agent skill. After a while many agents applied it to every development ticket, leaking features months from public release ^[11]. A skill is reusable instruction text, so a choice made once runs on every task that loads it. Glow advises reading the instructions and rules of any agent skill, and vetting the software and libraries used in development ^[13].

In my context the line is simple. A screenshot of a money-movement interface is as sensitive as the interface, and those recordings were in the exposed set ^[3]. Agent-captured images belong in the same authenticated store as the code they illustrate. An agent's credential should not be able to create a public repository. The agent in Glow's sample created one to hold two PNGs ^[10].