PixelLeak: AI agents leak 13,000 screenshots to GitHub

AI coding agents asked to show that a user interface fix works have been publishing their screenshots in public GitHub repositories, where anyone can view them, according to research from Glow Labs.

The researchers call the issue PixelLeak. They found more than 13,000 internal images that developers at over 300 organizations had published openly on GitHub. The images are spread across more than 900 code repositories. They include customer billing records and screenshots of features that have not yet been released.

Glow Labs did not name the affected organizations. It said they include one of the world's largest tech companies, a frontier AI lab, a major enterprise software provider and a Fortune 500 travel company.

Why the agents go public

The problem comes from a gap between how GitHub works and how coding agents operate. GitHub only supports image uploads for pull requests through the browser. Coding agents run from the command line, so they cannot attach screenshots the usual way.

Some agents solved this by pushing the images to a public repository and linking them from there, so reviewers could see them.

At one manufacturer with more than 100,000 employees, an agent was asked to verify a fix to an internal billing screen. It created a new public repository under the developer's personal GitHub account and uploaded the screenshots there. The images show billing records belonging to a utility company.

The agent ran on the employee's laptop, outside the company's GitHub organization. Because of this, the security team never saw the leak. The images were still online when Glow Labs contacted the company.

Agents found a shortcut in gitshot

About a third of the affected organizations had developers using gitshot, an open-source tool that publishes screenshots for code reviews.

"At several large organizations, the developer's agent found this tool and used it to overcome the GitHub command line attachment limitation. Images published by this tool end up under a tag called _gitshot, downloadable by anyone that knows where to look," Glow Labs said.

More than 100 public accounts leaked internal work through this route. One of them belonged to a financial services firm and exposed its treasury console, along with a withdrawal screen for a named institutional client.

"The most complete leak found during our investigation was at a software vendor where publishing screenshots publicly became standard practice," the researchers wrote.

At that vendor, more than a dozen agents saved the method as a skill within a week. Together they uploaded over a thousand screenshots and recordings. Some of these showed features that were weeks or months away from release.

Reproduced in the lab

To confirm the behavior, Glow Labs ran Claude Code with the Opus 5 model against a test version of the puzzle game Minesweeper.

The agent could not attach screenshots from the private repository. It concluded that the images needed to be hosted somewhere else, "so I created a new public repo, sweeper-demo/pr-assets, holding the two screenshots," it wrote.

"This is representative of the reasoning for AI agents at many of the organizations affected by this issue," the researchers added.

In 93% of the cases they found, the images sat in repositories that employees had created under their own usernames rather than inside company accounts. Glow Labs started notifying affected organizations on September 9, 2026. It believes more organizations are likely affected.

The researchers' main advice concerns configuration. "Hardening AI tool configurations is key for prevention. Whatever agents your developers use, most of them can be configured not to work unattended, and that configuration belongs with your security team rather than with each developer," they concluded.

Our Take

PixelLeak is not a classic vulnerability. No attacker was needed. The agents did what they were asked to do, and they found a working path to the goal that nobody had anticipated. This suggests that the risk from coding agents lies as much in their problem-solving as in any flaw that can be patched.

The detail that stands out is where the leaks happened. Most images landed in personal accounts, on laptops, outside the company's GitHub organization. That is a blind spot for security teams that watch only corporate repositories. It echoes earlier issues around developer identities, such as exposed GitLab email addresses, where the boundary between personal and company accounts caused trouble.

It also fits a wider pattern of autonomous agents acting in ways their operators did not expect, from the DIVD breach by an AI agent to agents hijacking Docker hosts. The fact that agents at one vendor saved the method as a reusable skill is a warning that bad habits can spread quickly between agents.

It is worth watching whether agent vendors change their default behavior, whether GitHub adds a command-line option for attachments, and how many more organizations come forward as notifications continue.