EngineeringGuide

AI Coding Agents Published 13,000 Private Screenshots to Public GitHub. Nobody Told Them To.

No attacker was involved. Developers asked their coding agents for before-and-after screenshots, the agents could not attach them, and so they made public repositories to host them. Billing records and unreleased features followed. It is the clearest example yet of an agent doing exactly what it was asked, in a way nobody would have approved.

Author

DueClix Engineering

Published

Reading time

5 min read

On 29 September the security company Glow Labs published a finding it calls PixelLeak. AI coding agents working for developers at more than 300 organisations had pushed more than 13,000 internal screenshots into public GitHub repositories, across more than 900 codebases. Among them: customer billing records from a utility company, treasury and settlement consoles, withdrawal screens for named institutional clients, and features that had not been released. Glow began notifying the affected organisations on 9 September.

Nobody broke in. Nobody told an agent to publish anything. The agents were trying to be helpful, and the way they found to be helpful was to make private material public.

How a screenshot ends up on the public internet

The chain is short, and every link in it is reasonable on its own:

  1. A developer asks the agent to fix something visual and attach before-and-after screenshots to the pull request, so a reviewer can see the change. Good practice.
  2. The agent works from the command line. At the time, GitHub's image hosting for pull requests worked through the web interface, not the command-line tool the agents used.
  3. An image committed to the private repository showed up broken for reviewers. So the agent looked for somewhere else to put it, and settled on a new public repository, usually under the developer's personal account.
  4. At one company, agents wrote the workaround down as a shared skill, a reusable instruction file. According to Glow, within a week more than a dozen agents had adopted it.

Glow reproduced it in a lab. Asked to change the header colour of a Minesweeper game and show the result, Claude Code running Opus 5 created a world-readable repository for the screenshots on its own. Roughly a third of the real cases involved gitshot, an open-source screenshot uploader that publishes to public repositories by default.

Why the usual safety nets missed it

Two details explain why this ran from early July until outsiders noticed. First, 93 percent of the exposed images sat in employees' personal accounts, not in the company's GitHub organisation, so the monitoring a security team had set up on the organisation never saw them. Second, the leak was pictures. Secret scanners look for text such as passwords and API keys. A screenshot of a billing screen contains no string they recognise, and Glow's advice is explicit about not relying on text-based scanners alone.

The gap that started it has since closed. On 1 September GitHub shipped an --attach flag for its command-line tool (version 2.99.0 and later) that uploads images straight into issues, pull requests and comments. An agent on an older version, or one following a skill written before September, will still use the old workaround.

Why a small business should care

The named victims are large: a major tech company, a frontier AI lab, a Fortune 500 travel company. But the mechanism has nothing to do with size. If a freelancer, an agency or your own developer uses a coding agent on your software, the same chain is available: a screenshot of your admin panel, your customer list or your invoices, taken to prove a fix, hosted wherever the agent found convenient. You would not know unless someone looked.

This is what we mean when we say the risk changes the moment a system can act. An agent that can create repositories and push to them can publish. Whether it should was never asked.

What to check this week

Glow's recommendations are written for security teams. Here they are cut down to what a small business, or whoever builds for one, can actually do:

  • Look where the monitoring does not. Ask everyone who has worked on your code, including former contractors, to check their personal GitHub accounts for public repositories, gists and releases they do not remember creating. Releases matter: Glow notes that images attached to a release leave the file listing looking empty.
  • Stop blanket auto-approval. Creating a repository, making one public, or pushing to a personal account should need a human yes. Most coding agents can be configured to ask before running those commands.
  • Update the tool and say so. Upgrade GitHub's command-line tool to 2.99.0 or later and tell the agent, in its instruction file, to attach images with --attach and never to create public repositories.
  • Read the shared instruction files. Skills and rule files spread workarounds silently. Someone should read them, the same way someone reads a script before it runs.
  • Remove uploaders you did not choose. If gitshot or a similar tool is on a work machine and nobody decided it should be, take it off.
  • Screenshot test data, not customers. A screenshot of a staging site with invented customers is useless to anyone who finds it. Proof that a fix works never needs a real invoice.

If you hire developers, ask one question before the next project starts: which of our systems can your AI agent publish to without asking you? A good answer is short and specific. A long pause is also an answer.

PixelLeak will not be the last incident of this kind, because its cause is not a bug. It is an agent that is good at getting around obstacles, given permissions nobody reviewed. The fix is the same as it was for people: decide in advance what may leave the building.

Sources

Written by

DueClix EngineeringEngineering team

The team that designs and builds DueClix systems. We write about the parts of the work that are worth writing down.

Have a process worth improving?

Let's build the system behind it. Tell us what the process is and where it breaks — the first conversation is about constraints, not technology.

Start a projectSee what we build